reurl.cc Open in urlscan Pro
35.229.143.32 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://web.alipearlhair.com/Wcc_JSq7#Conditions
Effective URL:
https://reurl.cc/4bojVj
Submission: On December 05 via api (December 5th 2025, 8:22:38 pm UTC) from FR — Scanned from PL

Summary HTTP 280 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 42 IPs in 8 countries across 37 domains to perform 280 HTTP transactions. The main IP is 35.229.143.32, located in Taipei, Taiwan and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is reurl.cc. The Cisco Umbrella rank of the primary domain is 313900.
TLS certificate: Issued by E7 on October 30th 2025. Valid for: 3 months.

This is the only time reurl.cc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	170.106.34.222 170.106.34.222	132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building)
8	35.229.143.32 35.229.143.32	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	151.101.129.229 151.101.129.229	54113 (FASTLY) (FASTLY)
2	151.101.65.55 151.101.65.55	54113 (FASTLY) (FASTLY)
6	142.250.186.136 142.250.186.136	15169 (GOOGLE) (GOOGLE)
49	65.8.131.4 65.8.131.4	16509 (AMAZON-02) (AMAZON-02)
2	203.74.221.3 203.74.221.3	131660 (CHTCDN Da...) (CHTCDN Data Communication Business Group)
9	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
6	142.250.185.142 142.250.185.142	15169 (GOOGLE) (GOOGLE)
8	216.239.34.36 216.239.34.36	15169 (GOOGLE) (GOOGLE)
4	74.125.71.155 74.125.71.155	15169 (GOOGLE) (GOOGLE)
5	172.217.18.3 172.217.18.3	15169 (GOOGLE) (GOOGLE)
19	35.74.59.205 35.74.59.205	16509 (AMAZON-02) (AMAZON-02)
19	157.240.253.1 157.240.253.1	32934 (FACEBOOK) (FACEBOOK)
6	18.66.122.42 18.66.122.42	16509 (AMAZON-02) (AMAZON-02)
6	116.50.36.71 116.50.36.71	18046 (DONGFONG-...) (DONGFONG-TW DongFong Technology Co. Ltd.)
11	35.75.149.212 35.75.149.212	16509 (AMAZON-02) (AMAZON-02)
5	34.95.67.231 34.95.67.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	18.178.75.163 18.178.75.163	16509 (AMAZON-02) (AMAZON-02)
26	203.75.214.136 203.75.214.136	3462 (HINET Dat...) (HINET Data Communication Business Group)
5 11	35.201.76.93 35.201.76.93	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
6 6	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
6	35.227.249.156 35.227.249.156	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	142.250.185.106 142.250.185.106	15169 (GOOGLE) (GOOGLE)
2	216.58.206.35 216.58.206.35	15169 (GOOGLE) (GOOGLE)
2	142.250.184.238 142.250.184.238	15169 (GOOGLE) (GOOGLE)
7	157.240.253.35 157.240.253.35	32934 (FACEBOOK) (FACEBOOK)
12	35.201.76.198 35.201.76.198	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	178.250.1.39 178.250.1.39	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE Criteo Technology SAS)
4	107.178.241.176 107.178.241.176	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	103.132.192.30 103.132.192.30	138552 (RTBHOUSE-...) (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD.)
1	210.59.219.34 210.59.219.34	3462 (HINET Dat...) (HINET Data Communication Business Group)
3 6	35.190.36.98 35.190.36.98	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 3	172.104.70.67 172.104.70.67	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
2	35.185.136.122 35.185.136.122	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1 1	52.213.88.74 52.213.88.74	16509 (AMAZON-02) (AMAZON-02)
1	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1	18.184.216.10 18.184.216.10	16509 (AMAZON-02) (AMAZON-02)
1 1	151.101.129.44 151.101.129.44	54113 (FASTLY) (FASTLY)
1	172.67.222.174 172.67.222.174	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.95.225 104.18.95.225	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.0.78.24 192.0.78.24	2635 (AUTOMATTIC) (AUTOMATTIC)
1	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	65.8.131.77 65.8.131.77	16509 (AMAZON-02) (AMAZON-02)
280	42

1 170.106.34.222 (Ashburn, United States) 1 redirects

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)

web.alipearlhair.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 35.229.143.32 (Taipei, Taiwan)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 32.143.229.35.bc.googleusercontent.com

reurl.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.129.229 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.65.55 (United States)

ASN54113 (FASTLY, US)

anymind360.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.186.136 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

49 65.8.131.4 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-8-131-4.fra60.r.cloudfront.net

cdn.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 203.74.221.3 (New Taipei City, Taiwan)

ASN131660 (CHTCDN Data Communication Business Group, TW)
PTR: 203-74-221-3.hinet-ip.hinet.net

ad-specs.guoshipartners.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f14.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 216.239.34.36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 74.125.71.155 (United States)

ASN15169 (GOOGLE, US)
PTR: wn-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.217.18.3 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f3.1e100.net

www.google.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 35.74.59.205 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com

ad.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 157.240.253.1 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra5.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
scontent.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 18.66.122.42 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-42.fra60.r.cloudfront.net

tracking-client.91app.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 116.50.36.71 (Taiwan)

ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW)
PTR: 116-50-36-71.dft.tw

cm.lndata.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 35.75.149.212 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com

cm-dev-poc.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.95.67.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.67.95.34.bc.googleusercontent.com

fcm.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.178.75.163 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-178-75-163.ap-northeast-1.compute.amazonaws.com

fcm2.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 203.75.214.136 (Taipei, Taiwan)

ASN3462 (HINET Data Communication Business Group, TW)
PTR: 203-75-214-136.hinet-ip.hinet.net

t.ssp.hinet.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 35.201.76.93 (Kansas City, United States) 5 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 93.76.201.35.bc.googleusercontent.com

c.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.162 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.227.249.156 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 156.249.227.35.bc.googleusercontent.com

m.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.106 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.206.35 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s10-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 157.240.253.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra5.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 35.201.76.198 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 198.76.201.35.bc.googleusercontent.com

track.91app.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.1.39 (France)

ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 107.178.241.176 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 176.241.178.107.bc.googleusercontent.com

onead.onevision.com.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.132.192.30 (Singapore)

ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG)
PTR: ip-103-132-192-30.rtbhouse.net

prebid-asia.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 210.59.219.34 (Taichung, Taiwan)

ASN3462 (HINET Data Communication Business Group, TW)
PTR: 210-59-219-34.hinet-ip.hinet.net

prebid.scupio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.190.36.98 (United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 98.36.190.35.bc.googleusercontent.com

ad2.apx.appier.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.104.70.67 (Tokyo, Japan) 3 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1680-67.members.linode.com

gocm.c.appier.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.185.136.122 (Taipei, Taiwan)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 122.136.185.35.bc.googleusercontent.com

re-news.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.213.88.74 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-88-74.eu-west-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.197.193.217 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.184.216.10 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-216-10.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.44 (United States) 1 redirects

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.222.174 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

nearbymed.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.95.225 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

mma.prnasia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.96.3 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

img.gbyhn.com.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.24 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

creditcards.com.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.97.3 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

img.racingcharger.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.8.131.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-8-131-77.fra60.r.cloudfront.net

static.wixstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
106	holmesmind.com 5 redirects cdn.holmesmind.com — Cisco Umbrella Rank: 237692 ad.holmesmind.com — Cisco Umbrella Rank: 143825 cm-dev-poc.holmesmind.com — Cisco Umbrella Rank: 230074 fcm.holmesmind.com — Cisco Umbrella Rank: 295745 fcm2.holmesmind.com — Cisco Umbrella Rank: 280119 c.holmesmind.com — Cisco Umbrella Rank: 157999 m.holmesmind.com — Cisco Umbrella Rank: 264664	327 KB
26	hinet.net t.ssp.hinet.net — Cisco Umbrella Rank: 89836 580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net	10 KB
19	doubleclick.net 6 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 255 stats.g.doubleclick.net — Cisco Umbrella Rank: 159 cm.g.doubleclick.net — Cisco Umbrella Rank: 296	250 KB
14	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 780 region1.analytics.google.com — Cisco Umbrella Rank: 3717	138 KB
12	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 865 scontent.xx.fbcdn.net — Cisco Umbrella Rank: 655	242 KB
12	91app.io track.91app.io — Cisco Umbrella Rank: 145118	2 KB
9	appier.net 6 redirects ad2.apx.appier.net — Cisco Umbrella Rank: 121001 gocm.c.appier.net — Cisco Umbrella Rank: 3048	2 KB
8	reurl.cc reurl.cc — Cisco Umbrella Rank: 313900	12 KB
7	facebook.com www.facebook.com — Cisco Umbrella Rank: 121	212 KB
7	facebook.net connect.facebook.net — Cisco Umbrella Rank: 212	198 KB
6	lndata.com cm.lndata.com — Cisco Umbrella Rank: 222357	2 KB
6	91app.com tracking-client.91app.com — Cisco Umbrella Rank: 200848	17 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	900 KB
5	google.pl www.google.pl — Cisco Umbrella Rank: 31066	748 B
4	onevision.com.tw onead.onevision.com.tw — Cisco Umbrella Rank: 165591	2 KB
3	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 126
2	re-news.tw re-news.tw	27 KB
2	criteo.net static.criteo.net — Cisco Umbrella Rank: 1000	46 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 57	21 KB
2	gstatic.com fonts.gstatic.com	82 KB
2	guoshipartners.com ad-specs.guoshipartners.com — Cisco Umbrella Rank: 183614	25 KB
2	anymind360.com anymind360.com — Cisco Umbrella Rank: 19502	174 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 284	58 KB
1	wixstatic.com static.wixstatic.com — Cisco Umbrella Rank: 6375	1011 KB
1	racingcharger.tw img.racingcharger.tw	742 KB
1	creditcards.com.tw creditcards.com.tw	47 KB
1	gbyhn.com.tw img.gbyhn.com.tw	61 KB
1	prnasia.com mma.prnasia.com — Cisco Umbrella Rank: 491627	50 KB
1	nearbymed.com nearbymed.com	17 KB
1	taboola.com 1 redirects trc.taboola.com — Cisco Umbrella Rank: 749	269 B
1	eyeota.net ps.eyeota.net — Cisco Umbrella Rank: 1030	354 B
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 419	149 B
1	crwdcntrl.net 1 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 1101	208 B
1	scupio.com prebid.scupio.com — Cisco Umbrella Rank: 109415	168 B
1	creativecdn.com prebid-asia.creativecdn.com — Cisco Umbrella Rank: 34260	171 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 44	6 KB
1	alipearlhair.com 1 redirects web.alipearlhair.com	1 KB
280	37

	Domain	Requested by
49	cdn.holmesmind.com	reurl.cc cdn.holmesmind.com ad.holmesmind.com
23	t.ssp.hinet.net	cdn.holmesmind.com t.ssp.hinet.net
19	ad.holmesmind.com	cdn.holmesmind.com reurl.cc
12	track.91app.io	tracking-client.91app.com
11	static.xx.fbcdn.net	www.facebook.com static.xx.fbcdn.net
11	c.holmesmind.com	5 redirects cdn.holmesmind.com
11	cm-dev-poc.holmesmind.com	cdn.holmesmind.com
9	securepubads.g.doubleclick.net	anymind360.com securepubads.g.doubleclick.net reurl.cc
8	region1.analytics.google.com	www.googletagmanager.com
8	reurl.cc	reurl.cc
7	www.facebook.com	connect.facebook.net reurl.cc static.xx.fbcdn.net
7	connect.facebook.net	reurl.cc connect.facebook.net fcm2.holmesmind.com
6	ad2.apx.appier.net	3 redirects reurl.cc
6	m.holmesmind.com	cdn.holmesmind.com
6	cm.g.doubleclick.net	6 redirects
6	cm.lndata.com	cdn.holmesmind.com
6	tracking-client.91app.com	cdn.holmesmind.com
6	fundingchoicesmessages.google.com	securepubads.g.doubleclick.net
6	www.googletagmanager.com	reurl.cc www.googletagmanager.com
5	fcm2.holmesmind.com	cdn.holmesmind.com
5	fcm.holmesmind.com	cdn.holmesmind.com
5	www.google.pl	reurl.cc
4	onead.onevision.com.tw	ad-specs.guoshipartners.com reurl.cc
4	stats.g.doubleclick.net	www.googletagmanager.com
3	580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net	cdn.holmesmind.com reurl.cc t.ssp.hinet.net
3	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
3	gocm.c.appier.net	3 redirects
2	re-news.tw	reurl.cc
2	static.criteo.net	cdn.holmesmind.com
2	www.google-analytics.com	reurl.cc www.google-analytics.com
2	fonts.gstatic.com	reurl.cc
2	ad-specs.guoshipartners.com	reurl.cc
2	anymind360.com	reurl.cc
2	cdn.jsdelivr.net	reurl.cc
1	static.wixstatic.com	reurl.cc
1	img.racingcharger.tw	reurl.cc
1	creditcards.com.tw	reurl.cc
1	img.gbyhn.com.tw	reurl.cc
1	mma.prnasia.com	reurl.cc
1	nearbymed.com	reurl.cc
1	trc.taboola.com	1 redirects
1	ps.eyeota.net	reurl.cc
1	match.adsrvr.org	reurl.cc
1	bcp.crwdcntrl.net	1 redirects
1	scontent.xx.fbcdn.net	www.facebook.com
1	prebid.scupio.com	cdn.holmesmind.com
1	prebid-asia.creativecdn.com	cdn.holmesmind.com
1	fonts.googleapis.com
1	web.alipearlhair.com	1 redirects
280	49

This site contains links to these domains. Also see Links.

Domain
30iptv.net
re-news.tw
youtils.cc
www.comptw.com
stockinfo.tw
ad.holmesmind.com
www.multiforce.com.tw

Subject Issuer	Validity	Valid
reurl.cc E7	`2025-10-30` - `2026-01-28`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2025 Q2	`2025-06-02` - `2026-07-04`	a year	crt.sh
anymind360.com R13	`2025-10-13` - `2026-01-11`	3 months	crt.sh
*.google-analytics.com WE2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
*.holmesmind.com Go Daddy Secure Certificate Authority - G2	`2025-03-06` - `2026-04-07`	a year	crt.sh
ad-specs.guoshipartners.com Go Daddy Secure Certificate Authority - G2	`2025-01-08` - `2026-01-21`	a year	crt.sh
*.g.doubleclick.net WE2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
*.google.com WE2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
*.google.pl WE2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
*.facebook.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-09-14` - `2025-12-13`	3 months	crt.sh
*.91app.com Amazon RSA 2048 M04	`2025-07-25` - `2026-08-22`	a year	crt.sh
*.lndata.com GeoTrust G5 TLS RSA4096 SHA384 2022 CA1	`2024-11-11` - `2025-12-12`	a year	crt.sh
*.t.ssp.hinet.net HiPKI OV TLS CA - G1	`2025-02-12` - `2026-02-12`	a year	crt.sh
upload.video.google.com WE2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
*.gstatic.com WE2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
track.91app.io WR3	`2025-10-28` - `2026-01-26`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-10-16` - `2026-01-18`	3 months	crt.sh
*.onevision.com.tw R13	`2025-12-01` - `2026-03-01`	3 months	crt.sh
*.creativecdn.com RapidSSL TLS RSA CA G1	`2025-04-17` - `2026-05-02`	a year	crt.sh
*.scupio.com Sectigo RSA Organization Validation Secure Server CA	`2025-09-02` - `2026-10-03`	a year	crt.sh
re-news.tw R12	`2025-12-04` - `2026-03-04`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2025-03-19` - `2026-04-02`	a year	crt.sh
eyeota.net GoGetSSL RSA DV CA	`2025-04-01` - `2026-05-02`	a year	crt.sh
nearbymed.com WE1	`2025-11-14` - `2026-02-12`	3 months	crt.sh
*.prnasia.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-10-21` - `2026-11-21`	a year	crt.sh
gbyhn.com.tw WE1	`2025-10-29` - `2026-01-27`	3 months	crt.sh
tls.automattic.com E7	`2025-10-20` - `2026-01-18`	3 months	crt.sh
racingcharger.tw WE1	`2025-10-10` - `2026-01-08`	3 months	crt.sh
*.wixstatic.com R12	`2025-11-16` - `2026-02-14`	3 months	crt.sh

This page contains 28 frames:

Primary Page: https://reurl.cc/4bojVj
Frame ID: 039DB8F44B4D6FF6E73EA58A8AAAD1D1
Requests: 69 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: 0D46D9E224703047BF9E5859B58D258A
Requests: 16 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 9D5D327ACAE3AC0887225915017EF2D6
Requests: 9 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: BC71287D71B93396997DD6ACB805B471
Requests: 25 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: BD96E0B938DB6F45EE70F4052744A665
Requests: 7 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 94FFF994AB2F3C7BDE3E2698707B5B62
Requests: 8 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 1807EF33FC3A4EE9ED7001A873F2AA87
Requests: 16 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: DD2F79BE4D7BA1F4A7C823967972A2C6
Requests: 9 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: 1963391B4A1ED724A6958A63F771211D
Requests: 11 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: 2345730EBA5C66334280B8E7F7FFA399
Requests: 11 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: 2103520F156680B7CED595A3BAAF5883
Requests: 11 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: BBAB64E1CE2B020B61FB925E29DC71A6
Requests: 11 HTTP requests in this frame

Frame: https://cm-dev-poc.holmesmind.com/fp
Frame ID: F933B4E3B3C796E8FE00F6E4A74AFEF0
Requests: 1 HTTP requests in this frame

Frame: https://fcm.holmesmind.com/cm.php
Frame ID: 736243951A654584669784ED7BBEA1F8
Requests: 1 HTTP requests in this frame

Frame: https://cm-dev-poc.holmesmind.com/fp
Frame ID: 76E739B7D8A0BC88DE2AA0E16AA1371E
Requests: 1 HTTP requests in this frame

Frame: https://fcm.holmesmind.com/cm.php
Frame ID: 6284E1A104D2004CA7F6B7A6C92B9F3D
Requests: 1 HTTP requests in this frame

Frame: https://cm-dev-poc.holmesmind.com/fp
Frame ID: 65E50C73F3F3BD974394BE9D2987E9F8
Requests: 1 HTTP requests in this frame

Frame: https://fcm.holmesmind.com/cm.php
Frame ID: 8024D94B07CE71A30D553517DD44BA38
Requests: 1 HTTP requests in this frame

Frame: https://cm-dev-poc.holmesmind.com/fp
Frame ID: A88F69DCB0F8705D1C082ED46BD3EB0B
Requests: 1 HTTP requests in this frame

Frame: https://fcm.holmesmind.com/cm.php
Frame ID: C418BA383D7CBCCF24D0165876BDA7EE
Requests: 1 HTTP requests in this frame

Frame: https://cm-dev-poc.holmesmind.com/fp
Frame ID: E36DD2AC5056740B5777E8129B98CAD2
Requests: 1 HTTP requests in this frame

Frame: https://fcm.holmesmind.com/cm.php
Frame ID: C386CA5B21751C1B009751C460609E01
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fhref%3Dhttps%253A%252F%252Fwww.facebook.com%252Freurl.cc%252F%26tabs%3Dtimeline%26width%3D340%26height%3D500%26small_header%3Dfalse%26adapt_container_width%3Dtrue%26hide_cover%3Dfalse%26show_facepile%3Dtrue%26appId
Frame ID: 0F9142174A90B5D2FB6AD59E834CEAB8
Requests: 26 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d
Frame ID: 2EA6A6D8A564706EFFD90EC580A55847
Requests: 9 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: D992F0A73D8743D6B6994A8F5B98C496
Requests: 12 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 182E65D4EA6B6E2486FC91C5D3AEDAB5
Requests: 17 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 94C95C18D06A5FAE472DB82384F9C1FD
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 4701BAC76426BEE90F91F98109A2FC8F
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Meilleur IPTV Abonnement en France

Page URL History Show full URLs

https://web.alipearlhair.com/Wcc_JSq7 HTTP 301
https://reurl.cc/4bojVj Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (UI frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Laravel (Web frameworks) Expand

Overall confidence: 100%
Detected patterns

Vue.js (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/vue(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

280
Requests

86 %
HTTPS

0 %
IPv6

37
Domains

49
Subdomains

42
IPs

8
Countries

4679 kB
Transfer

13344 kB
Size

35
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://30iptv.net/Davinci_JKE5
Title: 是，保持前往

Search URL Search Domain Scan URL

URL: https://re-news.tw/nearbymed/medical-technology-exhibit-insights-infant-care-pediatric-dental-health

Search URL Search Domain Scan URL

URL: https://re-news.tw/prnasia/4840113_XG40113_2

Search URL Search Domain Scan URL

URL: https://re-news.tw/gbyhn/71047

Search URL Search Domain Scan URL

URL: https://re-news.tw/creditcard/237079

Search URL Search Domain Scan URL

URL: https://re-news.tw/rich101/7295

Search URL Search Domain Scan URL

URL: https://re-news.tw/racingcharger/61273

Search URL Search Domain Scan URL

URL: https://re-news.tw/zocha/664f06a4333c44b7de8afda5

Search URL Search Domain Scan URL

URL: https://youtils.cc/emoji
Title: 表情符號(emoji)

Search URL Search Domain Scan URL

URL: https://youtils.cc/geoip
Title: IP查詢

Search URL Search Domain Scan URL

URL: https://youtils.cc/big5gb
Title: 繁簡轉換

Search URL Search Domain Scan URL

URL: https://youtils.cc/qrcode
Title: QRCode

Search URL Search Domain Scan URL

URL: https://youtils.cc/length
Title: 身高/長度換算

Search URL Search Domain Scan URL

URL: https://www.comptw.com/
Title: 台灣公司查詢網

Search URL Search Domain Scan URL

URL: https://stockinfo.tw/
Title: 台股資訊網

Search URL Search Domain Scan URL

URL: https://youtils.cc/wordcounter/zh-Hants
Title: 字數統計

Search URL Search Domain Scan URL

URL: https://youtils.cc/dateCalculator
Title: 日期計算機

Search URL Search Domain Scan URL

URL: https://youtils.cc/lunarCalendar
Title: 農曆轉國曆

Search URL Search Domain Scan URL

URL: https://youtils.cc/utm
Title: UTM網址

Search URL Search Domain Scan URL

URL: https://ad.holmesmind.com/adserver/c?p=14210:131880:236322:f144226e6da892c1211a9d9585901d51:14756&dest=https%3A%2F%2Fwww.clickforce.com.tw%2Fedcontent_d.php%3Flang%3Dtw%26tb%3D4%26id%3D7152%26utm_source%3Dmultiforce%26utm_medium%3Dpaid%26utm_campaign%3Dself_operation

Search URL Search Domain Scan URL

URL: https://www.multiforce.com.tw/home.jsp?lang=tw

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://web.alipearlhair.com/Wcc_JSq7 HTTP 301
https://reurl.cc/4bojVj Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 63

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 64

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1

Request Chain 69

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 73

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1

Request Chain 76

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 80

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1

Request Chain 83

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 87

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1

Request Chain 90

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 94

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1

Request Chain 136

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=mh2DAsxXAyCEK1vhEz8zaQ

Request Chain 185

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=uVJMaseDBT2VqEeDEz8zaQ

Request Chain 186

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=xFLGMdUJDqW3WyBrEz8zaQ

Request Chain 190

https://bcp.crwdcntrl.net/map/c=15135/tp=ONEA/lac=y?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id} HTTP 302
https://onead.onevision.com.tw/v2/pixel/ltm?id=

Request Chain 193

https://trc.taboola.com/sg/onedata/1/cm HTTP 302
https://onead.onevision.com.tw/v2/pixel/taboola?id=b968a6b7-b1d4-4ef3-ba85-b0575aa4c23c-tuct102cc492

Request Chain 208

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uu_m=undefined HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uu_m=undefined&google_error=1

280 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request 4bojVj Show response
reurl.cc/
Redirect Chain

https://web.alipearlhair.com/Wcc_JSq7
https://reurl.cc/4bojVj

16 KB
5 KB

1067ms
509ms

Document
text/html

35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/4bojVj
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 85d975fe1653f5887624fe0f43e807d29a8bab129f0ca6c85cc1a8fd65f5e537

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Fri, 05 Dec 2025 20:22:39 GMT
Server: nginx/1.22.1
Transfer-Encoding: chunked

Redirect headers

cache-control: no-cache
content-type: text/html; charset=UTF-8
date: Fri, 05 Dec 2025 20:22:38 GMT
location: https://reurl.cc/4bojVj
server: nginx
strict-transport-security: max-age=31536000

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/css/ 152 KB
26 KB 252ms
84ms Stylesheet
text/css 151.101.129.229
FASTLY

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/css/bootstrap.min.css

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.129.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"2606e-bhA1SChFSJj9qA9V897LNH/Z7SE"
age: 2711146
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-etou8220110-FRA, cache-vie6339-VIE
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25648
x-jsd-version: 4.3.1

GET
H/1.1 200
OK style.css
reurl.cc/asset/stylesheets/ 6 KB
2 KB 254ms
253ms Stylesheet
text/css 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/stylesheets/style.css?v=1
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 351966dece7214af3b43d9a94f07c1c936176ad5dd81f0bbe1f6b319b4cd96d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/4bojVj

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=604800
Content-Encoding: gzip
ETag: W/"69159a16-16bb"
Connection: keep-alive
Expires: Fri, 12 Dec 2025 20:22:39 GMT
Date: Fri, 05 Dec 2025 20:22:39 GMT
Content-Type: text/css
Last-Modified: Thu, 13 Nov 2025 08:43:02 GMT
Server: nginx/1.22.1
Vary: Accept-Encoding

GET
H2 200 ats.js Show response
anymind360.com/js/9479/ 380 KB
114 KB 216ms
88ms Script
application/javascript 151.101.65.55
FASTLY

General

Check archive.org

Download Go to

Full URL

https://anymind360.com/js/9479/ats.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.55 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

a7c26694861bbd926c7d903f707b406aa8eaa6a5065a3acb6c8e0028e8eaee6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
content-encoding: gzip
x-goog-hash: crc32c=+l4scw==, md5=RPhira7MebZTO3yL8IH51w==
etag: "44f862adaecc79b6533b7c8bf081f9d7"
age: 77746
x-goog-stored-content-encoding: gzip
expires: Thu, 04 Dec 2025 22:46:54 GMT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-goog-stored-content-length: 115683
x-cache: HIT, HIT
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 23 Sep 2025 04:37:48 GMT
x-served-by: cache-tyo11968-TYO, cache-vie6373-VIE
x-cache-hits: 314, 1
x-guploader-uploadid: AOCedOGIAz1q4EkYC6F9DEcTIIUPTfibVwykhzO-JsZZBsz-f6dytI7lQAqUnd5Ogj8jHNgB4Gw19Hk
strict-transport-security: max-age=31557600
vary: Accept-Encoding
cache-control: max-age=1200
x-goog-storage-class: STANDARD
x-timer: S1764966160.044456,VS0,VE6
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1758602268219650
content-length: 115683
server: UploadServer

GET
H/1.1 200
OK clickforce_anchor.js Show response
reurl.cc/asset/javascripts/common/ 1 KB
907 B 254ms
252ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/clickforce_anchor.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 873b90cdbff7dcb26e9ea34c647a5d15e83daecca768a816619dd38a503c09b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/4bojVj

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=604800
Content-Encoding: gzip
ETag: W/"687f3443-4bf"
Connection: keep-alive
Expires: Fri, 12 Dec 2025 20:22:40 GMT
Date: Fri, 05 Dec 2025 20:22:40 GMT
Content-Type: application/javascript
Last-Modified: Tue, 22 Jul 2025 06:48:35 GMT
Server: nginx/1.22.1
Vary: Accept-Encoding

GET
H/1.1 200
OK pixel.js Show response
reurl.cc/asset/javascripts/common/ 470 B
792 B 509ms
253ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/pixel.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 6e9ab8ab1d57a0695a66577e348ae4343e1a92f70cb4835a52c4863f11114037

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/4bojVj

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-1d6"
Connection: keep-alive
Expires: Fri, 12 Dec 2025 20:22:40 GMT
Accept-Ranges: bytes
Content-Length: 470
Date: Fri, 05 Dec 2025 20:22:40 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H/1.1 200
OK ga.js Show response
reurl.cc/asset/javascripts/common/ 566 B
888 B 942ms
457ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/ga.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 3774a7ce325859b32b6b0b01bde2879c75b81131fafe4a584b18b744711bd75d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/4bojVj

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-236"
Connection: keep-alive
Expires: Fri, 12 Dec 2025 20:22:41 GMT
Accept-Ranges: bytes
Content-Length: 566
Date: Fri, 05 Dec 2025 20:22:41 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 432 KB
145 KB 272ms
137ms Script
application/javascript 142.250.186.136
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

9c0a49abd67df4146a5f64eccddbdc7c1e0a2b3d7e535611ec4f7167dd4462ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 05 Dec 2025 20:22:40 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 148613
date: Fri, 05 Dec 2025 20:22:40 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 493 KB
161 KB 279ms
145ms Script
application/javascript 142.250.186.136
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

732e208e90e13189d119365b871cb4ea641565626b991a7813976dff09bcb5c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 05 Dec 2025 20:22:40 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164902
date: Fri, 05 Dec 2025 20:22:40 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ 9 KB
10 KB 276ms
112ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ab187b70940d331c60646d5731fa8e86d6958ba69dfa241361e39d30d81c2d31

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: PKBfBRh_ckEc5dxIcFkl8Hvvqrcpi_Dy
etag: "daceea64521f6f981e4b58edc119028a"
age: 45
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9646
x-amz-cf-id: kQOHbxgXCWiw6KoWGuXzivCEpX9CrwhEoXlcoOEFkiT3m_KazEYg7g==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Fri, 09 May 2025 03:01:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 ad-serv.min.js Show response
ad-specs.guoshipartners.com/static/js/ 52 KB
17 KB 1860ms
398ms Script
application/javascript 203.74.221.3
CHTCDN Data Commu...

General

Check archive.org

Download Go to

Full URL

https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

203.74.221.3 New Taipei City, Taiwan, ASN131660 (CHTCDN Data Communication Business Group, TW),

Reverse DNS

203-74-221-3.hinet-ip.hinet.net

Software

HiNetCDN / OneAD

Resource Hash

57e3fef09cab4680c25c4a06c9c1ce195325f5d502d4d75b5d53a7c2f14e2916

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: W/"68c28bcb-cfd3"
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
x-varnish: 24594342
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Thu, 11 Sep 2025 08:43:55 GMT
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=360
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: *
x-powered-by: OneAD
server: HiNetCDN

GET
H2 200 onead-lib.min.js Show response
ad-specs.guoshipartners.com/static/js/ 25 KB
8 KB 2048ms
586ms Script
application/javascript 203.74.221.3
CHTCDN Data Commu...

General

Check archive.org

Download Go to

Full URL

https://ad-specs.guoshipartners.com/static/js/onead-lib.min.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

203.74.221.3 New Taipei City, Taiwan, ASN131660 (CHTCDN Data Communication Business Group, TW),

Reverse DNS

203-74-221-3.hinet-ip.hinet.net

Software

HiNetCDN / OneAD

Resource Hash

620a382665ff035abb643a19e12f088aef2bc27b55398d4ae3f131b773be6355

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: W/"68c0e8bd-65e4"
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
x-varnish: 130662986
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Wed, 10 Sep 2025 02:55:57 GMT
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=360
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: *
x-powered-by: OneAD
server: HiNetCDN

GET
H2 200 vue.min.js Show response
cdn.jsdelivr.net/npm/vue@2.5.16/dist/ 84 KB
32 KB 60ms
59ms Script
application/javascript 151.101.129.229
FASTLY

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue@2.5.16/dist/vue.min.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.129.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4da2dc78cc23591a9ee3285ba8f3891fa57b506b7902fbdd35fa5a2172566c55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"151b4-KLsckeN7U/TrtIzkgtzLJAAD4Hg"
age: 1152150
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230088-FRA, cache-vie6339-VIE
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 32610
x-jsd-version: 2.5.16

GET
H/1.1 200
OK renews.js Show response
reurl.cc/asset/javascripts/common/ 690 B
1012 B 944ms
456ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/renews.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 100d72a28123bcee974e8642b8bf1c0865bf1034c9b59f59597d53809e192fdc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/4bojVj

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-2b2"
Connection: keep-alive
Expires: Fri, 12 Dec 2025 20:22:41 GMT
Accept-Ranges: bytes
Content-Length: 690
Date: Fri, 05 Dec 2025 20:22:41 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H/1.1 200
OK loading.js Show response
reurl.cc/asset/javascripts/redirect/ 240 B
561 B 946ms
458ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/redirect/loading.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 25355805f44af99037c6b951f9afd762f5fd74eb126aba4b2f82cafa563c0f90

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/4bojVj

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-f0"
Connection: keep-alive
Expires: Fri, 12 Dec 2025 20:22:41 GMT
Accept-Ranges: bytes
Content-Length: 240
Date: Fri, 05 Dec 2025 20:22:41 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 105 KB
33 KB 134ms
64ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: anymind360.com
URL: https://anymind360.com/js/9479/ats.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

942be2506062746af49ca904cb7cfb0525cf8f0458f26b150beccfd5c76f1abf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 781 / 20427 / m202512020101 / config-hash: 5063855111797697403
x-content-type-options: nosniff
expires: Fri, 05 Dec 2025 20:22:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34189
x-xss-protection: 0
server: cafe

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 424 KB
144 KB 210ms
76ms Script
application/javascript 142.250.186.136
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

eaa389a2363ce41b4ddfe710ee8fafbe17cac66f85450ccfbc40ab90e66d7dc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 05 Dec 2025 20:22:40 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146688
date: Fri, 05 Dec 2025 20:22:40 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512020101/ 609 KB
193 KB 49ms
49ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512020101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

cdf207042b9030c6e625d7042dac68355209cda211f30a59d25b2b4baafd8c1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 10021983320797522262
age: 11497
x-content-type-options: nosniff
expires: Sat, 05 Dec 2026 17:11:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 05 Dec 2025 17:11:03 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 197115
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202512040101/ 64 KB
22 KB 57ms
56ms Other
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202512040101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

8d23693251d0923a21dba7083e1e3a58a18123b146cebbcefb828e1caa7c3aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 4740477158928784528
age: 15673
x-content-type-options: nosniff
expires: Fri, 12 Dec 2025 16:01:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 05 Dec 2025 16:01:27 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 22756
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202512040101"

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame 0D46 12 KB
12 KB 240ms
106ms Document
text/html 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 59
content-length: 12184
content-type: text/html
date: Fri, 05 Dec 2025 20:21:43 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 c8441ee313b5204aa32e9bf5a370d536.cloudfront.net (CloudFront)
x-amz-cf-id: ehkDwjsif9m8s39ofOjLAs0Wr6QkbPd2ysePEBjGsZXK-lUZFpXQGQ==
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 9D5D 11 KB
11 KB 102ms
102ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: qBmZmL891DJ0nM0tgLDrbpha1KGsWhy3Flg5L-liXjIpD0nG9CbQBQ==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame BC71 11 KB
0 100ms
100ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: qBmZmL891DJ0nM0tgLDrbpha1KGsWhy3Flg5L-liXjIpD0nG9CbQBQ==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame BD96 11 KB
0 98ms
98ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: qBmZmL891DJ0nM0tgLDrbpha1KGsWhy3Flg5L-liXjIpD0nG9CbQBQ==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 94FF 11 KB
0 96ms
96ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: qBmZmL891DJ0nM0tgLDrbpha1KGsWhy3Flg5L-liXjIpD0nG9CbQBQ==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 1807 11 KB
0 94ms
94ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: qBmZmL891DJ0nM0tgLDrbpha1KGsWhy3Flg5L-liXjIpD0nG9CbQBQ==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame DD2F 11 KB
0 93ms
93ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: qBmZmL891DJ0nM0tgLDrbpha1KGsWhy3Flg5L-liXjIpD0nG9CbQBQ==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame 1963 12 KB
0 226ms
226ms Document
text/html 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 59
content-length: 12184
content-type: text/html
date: Fri, 05 Dec 2025 20:21:43 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 c8441ee313b5204aa32e9bf5a370d536.cloudfront.net (CloudFront)
x-amz-cf-id: ehkDwjsif9m8s39ofOjLAs0Wr6QkbPd2ysePEBjGsZXK-lUZFpXQGQ==
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame 2345 12 KB
0 227ms
227ms Document
text/html 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 59
content-length: 12184
content-type: text/html
date: Fri, 05 Dec 2025 20:21:43 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 c8441ee313b5204aa32e9bf5a370d536.cloudfront.net (CloudFront)
x-amz-cf-id: ehkDwjsif9m8s39ofOjLAs0Wr6QkbPd2ysePEBjGsZXK-lUZFpXQGQ==
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame 2103 12 KB
0 228ms
228ms Document
text/html 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 59
content-length: 12184
content-type: text/html
date: Fri, 05 Dec 2025 20:21:43 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 c8441ee313b5204aa32e9bf5a370d536.cloudfront.net (CloudFront)
x-amz-cf-id: ehkDwjsif9m8s39ofOjLAs0Wr6QkbPd2ysePEBjGsZXK-lUZFpXQGQ==
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame BBAB 12 KB
0 229ms
229ms Document
text/html 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 59
content-length: 12184
content-type: text/html
date: Fri, 05 Dec 2025 20:21:43 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 c8441ee313b5204aa32e9bf5a370d536.cloudfront.net (CloudFront)
x-amz-cf-id: ehkDwjsif9m8s39ofOjLAs0Wr6QkbPd2ysePEBjGsZXK-lUZFpXQGQ==
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 128002626 Show response
fundingchoicesmessages.google.com/i/ 214 KB
69 KB 263ms
108ms Script
application/javascript 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/128002626?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512020101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

ESF /

Resource Hash

24973a749cdbc649e2a96f6eac9ff3ed1ad2f3bc5e9ce8d3cb07d3d0a33293d8

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-B5H5-281XHLcPGaoGUTQZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjmsGoxSXF4KUhxXDy1m2mi0DcevMc61Qg7lp0nnUWEBsqXGJ1BOIP9ZdZfwBxkcQV1iYg_lR1g1Wo-gZrEvtN1iIgNvO7zWoHxNXuXmzNQGzr78PmCsTfin3Z2Ep82fb992U7BsR7c_zYjgJxZqcfWyEQn9_rx3YdiFff9GPbDMQrvPzZNgCxEA_HhH9nTrIJzOi92sSspJGUXxifnJ9XUpSZVFqSX5SWnJZanFpUlloUb2RgZGpoZGCiZ2AeX2AAAE_tUHQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-B5H5-281XHLcPGaoGUTQZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 432 KB
145 KB 67ms
65ms Script
application/javascript 142.250.186.136
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1&cx=c&gtm=4e5c31

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

de2f37247915d4d168ac703231fe1bf5d5d1ec670928b3e86c409870ecc35167

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 05 Dec 2025 20:22:40 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 148678
date: Fri, 05 Dec 2025 20:22:40 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 493 KB
161 KB 92ms
90ms Script
application/javascript 142.250.186.136
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0&cx=c&gtm=4e5c31

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

81f5894460e95b43b98c07da054ab3c7a9e0a63c2c49f27c28d4a4ec4096c149

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 05 Dec 2025 20:22:40 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164908
date: Fri, 05 Dec 2025 20:22:40 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 144ms
59ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-S9B9ZLEX4D&gtm=45je5c31v9235665865za200zd9235665865&_p=1764966160210&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&cid=1361717008.1764966161&ul=pl-pl&sr=1600x1200&_ng=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391253~115497441~115583767~115616985~115938466~115938469~116184927~116184929~116217636~116217638~116474638&sid=1764966160&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F4bojVj&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2451
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
553 B 200ms
84ms Ping
text/plain 74.125.71.155
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ng=1&tid=G-S9B9ZLEX4D&cid=1361717008.1764966161&gtm=45je5c31v9235665865za200zd9235665865&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391253~115497441~115583767~115616985~115938466~115938469~116184927~116184929~116217636~116217638~116474638
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.71.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wn-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 ga-audiences
www.google.pl/ads/ 42 B
408 B 276ms
168ms Image
image/gif 172.217.18.3
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.pl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ng=1&tid=G-S9B9ZLEX4D&cid=1361717008.1764966161&gtm=45je5c31v9235665865za200zd9235665865&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391253~115497441~115583767~115616985~115938466~115938469~116184927~116184929~116217636~116217638~116474638&z=2001705169

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 05 Dec 2025 20:22:40 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 9D5D 2 KB
632 B 1105ms
520ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=13858
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: eba9a487e95bf24fc365b6581165276a5989b9a98df6a50ed0e56bccc2822f8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 9D5D 30 KB
30 KB 71ms
70ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: S4C-P7xkUW14QviCzPQXqMKaoB9QSuZ-acktnPX_PCr7pu5JdHy4Pg==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame BC71 2 KB
852 B 1132ms
547ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f7d2701889f81b41c32ea429a484f62fbe8f04db715f32dac597f6aba3a9331d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame BC71 30 KB
0 71ms
71ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: S4C-P7xkUW14QviCzPQXqMKaoB9QSuZ-acktnPX_PCr7pu5JdHy4Pg==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame DD2F 820 B
506 B 1101ms
517ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=22213
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 2f46f1b48f154c914566b81946177099d828e99bec918e3e0516326434b630b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame DD2F 30 KB
0 71ms
71ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: S4C-P7xkUW14QviCzPQXqMKaoB9QSuZ-acktnPX_PCr7pu5JdHy4Pg==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 1807 820 B
505 B 1235ms
759ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=18535
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 2f46f1b48f154c914566b81946177099d828e99bec918e3e0516326434b630b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 1807 30 KB
0 70ms
70ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: S4C-P7xkUW14QviCzPQXqMKaoB9QSuZ-acktnPX_PCr7pu5JdHy4Pg==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 94FF 1 KB
609 B 907ms
517ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=13861
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 4160fa3d770eaab9357e77de1ceb06e03b04d4392adc870d2485110517b3747e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 94FF 30 KB
0 70ms
70ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: S4C-P7xkUW14QviCzPQXqMKaoB9QSuZ-acktnPX_PCr7pu5JdHy4Pg==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame BD96 2 KB
632 B 833ms
520ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=13860
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: eba9a487e95bf24fc365b6581165276a5989b9a98df6a50ed0e56bccc2822f8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame BD96 30 KB
0 73ms
73ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: S4C-P7xkUW14QviCzPQXqMKaoB9QSuZ-acktnPX_PCr7pu5JdHy4Pg==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 80ms
61ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-N394QBRGC0&gtm=45je5c31v897965293za200zb9235665865zd9235665865&_p=1764966160210&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&cid=1361717008.1764966161&ul=pl-pl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391252~115583767~115938466~115938469~116184927~116184929~116217636~116217638~116474638&sid=1764966160&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F4bojVj&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2515
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
48 B 57ms
56ms Ping
text/plain 74.125.71.155
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-N394QBRGC0&cid=1361717008.1764966161&gtm=45je5c31v897965293za200zb9235665865zd9235665865&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391252~115583767~115938466~115938469~116184927~116184929~116217636~116217638~116474638
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.71.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wn-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 ga-audiences
www.google.pl/ads/ 42 B
107 B 108ms
106ms Image
image/gif 172.217.18.3
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.pl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-N394QBRGC0&cid=1361717008.1764966161&gtm=45je5c31v897965293za200zb9235665865zd9235665865&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391252~115583767~115938466~115938469~116184927~116184929~116217636~116217638~116474638&z=1055929578

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 05 Dec 2025 20:22:40 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 56ms
56ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-ZDFZCDVDK1&gtm=45je5c40h2v9181474282za200zb9235665865zd9235665865&_p=1764966160210&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&cid=1361717008.1764966161&ecid=985653488&ul=pl-pl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&ec_mode=a&_s=1&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391253~115583767~115938466~115938468~116184927~116184929~116217636~116217638~116474638&sid=1764966160&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F4bojVj&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2540
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
48 B 87ms
87ms Ping
text/plain 74.125.71.155
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-ZDFZCDVDK1&cid=1361717008.1764966161&gtm=45je5c40h2v9181474282za200zb9235665865zd9235665865&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391253~115583767~115938466~115938468~116184927~116184929~116217636~116217638~116474638
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.71.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wn-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 ga-audiences
www.google.pl/ads/ 42 B
107 B 179ms
178ms Image
image/gif 172.217.18.3
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.pl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-ZDFZCDVDK1&cid=1361717008.1764966161&gtm=45je5c40h2v9181474282za200zb9235665865zd9235665865&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391253~115583767~115938466~115938468~116184927~116184929~116217636~116217638~116474638&z=1899707914

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 05 Dec 2025 20:22:40 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 332 KB
87 KB 115ms
53ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/asset/javascripts/common/pixel.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

eff958d6a66dede8a64c252dcf84e69d34c888460d5fcf6f835e655ab487d352

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-uiT8nVzo' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-uiT8nVzo' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=23, mss=1232, tbw=4962, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: NykyUZ/wn6jy4C5yC2aK4NRuqaRY5ABONJH4itCw1WKf9G6a8CTu7mCz6BQWiVW0Khabr2eU2K6ZpDGZjwR9qQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 88493
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame 0D46 42 KB
17 KB 301ms
105ms Script
application/javascript 18.66.122.42
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-42.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0f390ce52e359572f07f6a2fb047858bdbdea327f0049589d71f6f31fd48d7f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: gzip
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 147
via: 1.1 db1cc9ceb7681bf2a56c0f22acac3a36.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: Rla2RO8xy1IFEe4PJ-5Ng9JIAuqv6OpTt053L4Yz6LfjXoZPVhAX8Q==
date: Fri, 05 Dec 2025 20:20:18 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame 1963 42 KB
0 300ms
300ms Script
application/javascript 18.66.122.42
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-42.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0f390ce52e359572f07f6a2fb047858bdbdea327f0049589d71f6f31fd48d7f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: gzip
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 147
via: 1.1 db1cc9ceb7681bf2a56c0f22acac3a36.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: Rla2RO8xy1IFEe4PJ-5Ng9JIAuqv6OpTt053L4Yz6LfjXoZPVhAX8Q==
date: Fri, 05 Dec 2025 20:20:18 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame 2345 42 KB
0 298ms
298ms Script
application/javascript 18.66.122.42
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-42.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0f390ce52e359572f07f6a2fb047858bdbdea327f0049589d71f6f31fd48d7f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: gzip
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 147
via: 1.1 db1cc9ceb7681bf2a56c0f22acac3a36.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: Rla2RO8xy1IFEe4PJ-5Ng9JIAuqv6OpTt053L4Yz6LfjXoZPVhAX8Q==
date: Fri, 05 Dec 2025 20:20:18 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK /
cm.lndata.com/ Frame 0D46 35 B
470 B 1040ms
253ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

Content-Length: 35
P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Date: Fri, 05 Dec 2025 20:22:41 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Connection: keep-alive
Server: TornadoServer/1.2.1

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame F933 0
218 B 1177ms
582ms Document
text/html 35.75.149.212
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.149.212 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 05 Dec 2025 20:22:41 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H2 200 cm.php Show response
fcm.holmesmind.com/ Frame 7362 39 B
182 B 242ms
142ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
content-type: text/html; charset=UTF-8
date: Fri, 05 Dec 2025 20:22:40 GMT
server: Apache/2.4.29 (Ubuntu)
via: 1.1 google

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame 0D46 409 B
632 B 1188ms
582ms Script
application/javascript 18.178.75.163
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.178.75.163 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-178-75-163.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 0D46 5 KB
3 KB 1417ms
667ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 05 Dec 2025 20:32:42 GMT
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame 0D46 0
217 B 1176ms
583ms Image
text/html 35.75.149.212
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.149.212 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

cm
c.holmesmind.com/ Frame 0D46
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
499 B

189ms
188ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame 0D46
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1

0
453 B

161ms
59ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 2344
x-goog-stored-content-encoding: identity
expires: Fri, 05 Dec 2025 20:43:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 05 Dec 2025 19:43:37 GMT
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
content-type: image/png
x-guploader-uploadid: AOCedOGXcn5HSNrfG7QMeSc_HQfxsm37uDciy_GA2vCSGs33Ew79XyRKWWlOFqXauQorgYCZ
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 286
date: Fri, 05 Dec 2025 20:22:40 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame 2103 42 KB
0 294ms
294ms Script
application/javascript 18.66.122.42
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-42.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0f390ce52e359572f07f6a2fb047858bdbdea327f0049589d71f6f31fd48d7f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: gzip
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 147
via: 1.1 db1cc9ceb7681bf2a56c0f22acac3a36.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: Rla2RO8xy1IFEe4PJ-5Ng9JIAuqv6OpTt053L4Yz6LfjXoZPVhAX8Q==
date: Fri, 05 Dec 2025 20:20:18 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame BBAB 42 KB
0 292ms
292ms Script
application/javascript 18.66.122.42
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-42.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0f390ce52e359572f07f6a2fb047858bdbdea327f0049589d71f6f31fd48d7f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: gzip
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 147
via: 1.1 db1cc9ceb7681bf2a56c0f22acac3a36.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: Rla2RO8xy1IFEe4PJ-5Ng9JIAuqv6OpTt053L4Yz6LfjXoZPVhAX8Q==
date: Fri, 05 Dec 2025 20:20:18 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK /
cm.lndata.com/ Frame 1963 35 B
394 B 1295ms
260ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Fri, 05 Dec 2025 20:22:41 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame 1963 0
217 B 1628ms
457ms Image
text/html 35.75.149.212
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.149.212 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame 1963
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
17 B

186ms
156ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame 76E7 0
217 B 1657ms
486ms Document
text/html 35.75.149.212
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.149.212 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 05 Dec 2025 20:22:42 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H2 200 cm.php Show response
fcm.holmesmind.com/ Frame 6284 39 B
97 B 379ms
142ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
content-type: text/html; charset=UTF-8
date: Fri, 05 Dec 2025 20:22:41 GMT
server: Apache/2.4.29 (Ubuntu)
via: 1.1 google

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame 1963 409 B
631 B 1636ms
454ms Script
application/javascript 18.178.75.163
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.178.75.163 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-178-75-163.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame 1963
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1

0
0

82ms
82ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 2344
x-goog-stored-content-encoding: identity
expires: Fri, 05 Dec 2025 20:43:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 05 Dec 2025 19:43:37 GMT
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
content-type: image/png
x-guploader-uploadid: AOCedOGXcn5HSNrfG7QMeSc_HQfxsm37uDciy_GA2vCSGs33Ew79XyRKWWlOFqXauQorgYCZ
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 286
date: Fri, 05 Dec 2025 20:22:41 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK /
cm.lndata.com/ Frame 2345 35 B
394 B 1553ms
256ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Fri, 05 Dec 2025 20:22:42 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame 2345 0
217 B 1902ms
275ms Image
text/html 35.75.149.212
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.149.212 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame 2345
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
12 B

187ms
156ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame 65E5 0
217 B 2145ms
489ms Document
text/html 35.75.149.212
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.149.212 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 05 Dec 2025 20:22:42 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H3 200 cm.php Show response
fcm.holmesmind.com/ Frame 8024 39 B
52 B 521ms
142ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
content-type: text/html; charset=UTF-8
date: Fri, 05 Dec 2025 20:22:41 GMT
server: Apache/2.4.29 (Ubuntu)
via: 1.1 google

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame 2345 409 B
631 B 1907ms
272ms Script
application/javascript 18.178.75.163
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.178.75.163 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-178-75-163.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame 2345
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1

0
0

19ms
19ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 2344
x-goog-stored-content-encoding: identity
expires: Fri, 05 Dec 2025 20:43:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 05 Dec 2025 19:43:37 GMT
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
content-type: image/png
x-guploader-uploadid: AOCedOGXcn5HSNrfG7QMeSc_HQfxsm37uDciy_GA2vCSGs33Ew79XyRKWWlOFqXauQorgYCZ
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 286
date: Fri, 05 Dec 2025 20:22:41 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK /
cm.lndata.com/ Frame 2103 35 B
394 B 1805ms
253ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Fri, 05 Dec 2025 20:22:42 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame 2103 0
217 B 2388ms
488ms Image
text/html 35.75.149.212
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.149.212 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame 2103
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
12 B

189ms
156ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame A88F 0
217 B 2632ms
489ms Document
text/html 35.75.149.212
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.149.212 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 05 Dec 2025 20:22:43 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H3 200 cm.php Show response
fcm.holmesmind.com/ Frame C418 39 B
54 B 663ms
143ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
content-type: text/html; charset=UTF-8
date: Fri, 05 Dec 2025 20:22:41 GMT
server: Apache/2.4.29 (Ubuntu)
via: 1.1 google

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame 2103 409 B
631 B 2179ms
273ms Script
application/javascript 18.178.75.163
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.178.75.163 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-178-75-163.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame 2103
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1

0
0

0ms
0ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 2344
x-goog-stored-content-encoding: identity
expires: Fri, 05 Dec 2025 20:43:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 05 Dec 2025 19:43:37 GMT
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
content-type: image/png
x-guploader-uploadid: AOCedOGXcn5HSNrfG7QMeSc_HQfxsm37uDciy_GA2vCSGs33Ew79XyRKWWlOFqXauQorgYCZ
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 286
date: Fri, 05 Dec 2025 20:22:41 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK /
cm.lndata.com/ Frame BBAB 35 B
394 B 2056ms
252ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Fri, 05 Dec 2025 20:22:42 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame BBAB 0
217 B 2876ms
489ms Image
text/html 35.75.149.212
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.149.212 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame BBAB
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
12 B

184ms
158ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame E36D 0
217 B 3120ms
489ms Document
text/html 35.75.149.212
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.149.212 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 05 Dec 2025 20:22:43 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H3 200 cm.php Show response
fcm.holmesmind.com/ Frame C386 39 B
52 B 807ms
145ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
content-type: text/html; charset=UTF-8
date: Fri, 05 Dec 2025 20:22:41 GMT
server: Apache/2.4.29 (Ubuntu)
via: 1.1 google

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame BBAB 409 B
631 B 2450ms
272ms Script
application/javascript 18.178.75.163
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.178.75.163 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-178-75-163.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame BBAB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1

0
0

0ms
0ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 2344
x-goog-stored-content-encoding: identity
expires: Fri, 05 Dec 2025 20:43:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 05 Dec 2025 19:43:37 GMT
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
content-type: image/png
x-guploader-uploadid: AOCedOGXcn5HSNrfG7QMeSc_HQfxsm37uDciy_GA2vCSGs33Ew79XyRKWWlOFqXauQorgYCZ
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_error=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 286
date: Fri, 05 Dec 2025 20:22:41 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

POST
H3 204 AGSKWxXLR2HPIejm2rUg4hcyjYUi8DIDm86_QzQxxqN70ayMTWIoe3Hi5q0J6urEVb9PLuv3dzQrf_l0rqz0rCJlneQRPOhFA63LJkk_jYoTShfJRrqXcm-ZZAssmJOx6xaw1oIMW5xbkg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 117ms
59ms XHR
text/html 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXLR2HPIejm2rUg4hcyjYUi8DIDm86_QzQxxqN70ayMTWIoe3Hi5q0J6urEVb9PLuv3dzQrf_l0rqz0rCJlneQRPOhFA63LJkk_jYoTShfJRrqXcm-ZZAssmJOx6xaw1oIMW5xbkg==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.pl.RcR3kUpOxDM.es5.O/d=1/rs=AJlcJMy9klis_bWQ95-FYBRkovv8dQ7Gkw/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-pukRGFs0sV2mSJcORBKhIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj8tDikmJw0pBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiM_v9WO7DsSrb_qxbQZiIW6Oif_OnGQT2NH9nk3JJSm_MD45P68kNa9ENzGlWBfELspMKi3JL0Jhp5aBVOTkp6dn5qXHGxkYmRoaGZjoGZjHFxgAABijOEU"
content-security-policy: script-src 'report-sample' 'nonce-pukRGFs0sV2mSJcORBKhIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXLR2HPIejm2rUg4hcyjYUi8DIDm86_QzQxxqN70ayMTWIoe3Hi5q0J6urEVb9PLuv3dzQrf_l0rqz0rCJlneQRPOhFA63LJkk_jYoTShfJRrqXcm-ZZAssmJOx6xaw1oIMW5xbkg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-VhFWlWMI-8NepqyebVZ7xQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj8tDikmJw1ZBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiM_v9WO7DsSrb_qxbQZiIW6Oif_OnGQT2PH6PJuSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjU0MjDRMzCPLzAAACzIOIg"
content-security-policy: script-src 'report-sample' 'nonce-VhFWlWMI-8NepqyebVZ7xQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 AGSKWxVWi1gZ488uJmxXF26A8Lj5zEr8TzLi7UpugUtR5vkJ65FLsnNMswER-tDqS4_BIVm8pEHoO7JCNskiE49RgFkD9jEUepI0BOyixUKSLpExDsfk0u7VoBe9yXD7kMzbmkYMYUyvkQ== Show response
fundingchoicesmessages.google.com/f/ 459 KB
69 KB 110ms
109ms Script
application/javascript 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVWi1gZ488uJmxXF26A8Lj5zEr8TzLi7UpugUtR5vkJ65FLsnNMswER-tDqS4_BIVm8pEHoO7JCNskiE49RgFkD9jEUepI0BOyixUKSLpExDsfk0u7VoBe9yXD7kMzbmkYMYUyvkQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzY0OTY2MTYwLDkzMzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9yZXVybC5jYy80Ym9qVmoiLG51bGwsW1s4LCJSY1Iza1VwT3hETSJdLFs5LCJwbCJdLFsxOSwiMSJdLFsxNywiWzBdIl0sWzI0LCIiXSxbMjUsIltbOTUzNDAyNTMsOTUzNDAyNTVdXSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

ESF /

Resource Hash

6092c7e0cb5d5573df0d0c7e4612a54cfe97569131f48425f820214493e6ac70

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-QbvRXojb3o4ddg6eh0uflA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjmsCoxSXFEKwhxdB68xzrVCDuWnSedRYQGypcYnUE4g_1l1l_AHGRxBXWJiD-VHWDVaj6BmsS-03WIiA287vNagfE1e5ebM1AbOvvw-YKxN-KfdnYSnzZ9v33ZTsGxHtz_NiOAnFmpx9bIRCf3-vHdh2IV9_0Y9sMxCu8_Nk2ALEQN8fEf2dOsgk8mLWUU0kjKb8wPjk_r6QoM6m0JL8oLTkttTi1qCy1KN7IwMjU0MjARM_APL7AAAAabksW"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-QbvRXojb3o4ddg6eh0uflA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ 123 KB
6 KB 246ms
112ms Stylesheet
text/css 142.250.185.106
GOOGLE

General

Check archive.org

Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.pl.RcR3kUpOxDM.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMy9klis_bWQ95-FYBRkovv8dQ7Gkw/m=web_iab_tcf_v2_wall_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f10.1e100.net

Software

ESF /

Resource Hash

c03e2d819d8b3afb3db6440a0b76e8c5428e59b9e7de6740554a225e1ba87f0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 05 Dec 2025 20:22:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 05 Dec 2025 20:22:41 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 119ms
64ms Font
font/woff2 216.58.206.35
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f3.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

age: 88691
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 04 Dec 2026 19:44:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 04 Dec 2025 19:44:30 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2
fonts.gstatic.com/s/opensans/v40/ 35 KB
35 KB 106ms
50ms Font
font/woff2 216.58.206.35
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f3.1e100.net

Software

sffe /

Resource Hash

adfa45260a1306cb5fefc1f17c1b5e7b61135534a82bf1b8e3d0540af7e07e3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

age: 88715
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 04 Dec 2026 19:44:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 04 Dec 2025 19:44:06 GMT
last-modified: Thu, 14 Dec 2023 02:00:45 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 35328
x-xss-protection: 0
server: sffe

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXLR2HPIejm2rUg4hcyjYUi8DIDm86_QzQxxqN70ayMTWIoe3Hi5q0J6urEVb9PLuv3dzQrf_l0rqz0rCJlneQRPOhFA63LJkk_jYoTShfJRrqXcm-ZZAssmJOx6xaw1oIMW5xbkg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-pxv0UJUmWho0rkrukUQP8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj8tDikmLw0JBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiM_v9WO7DsSrb_qxbQZiIW6Oif_OnGQT2PDuma-SS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjU0MjDRMzCPLzAAAEdBOOQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-pxv0UJUmWho0rkrukUQP8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXLR2HPIejm2rUg4hcyjYUi8DIDm86_QzQxxqN70ayMTWIoe3Hi5q0J6urEVb9PLuv3dzQrf_l0rqz0rCJlneQRPOhFA63LJkk_jYoTShfJRrqXcm-ZZAssmJOx6xaw1oIMW5xbkg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-y-M06syrowNbYgA3dFnCfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj8tDikmJw1pBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiM_v9WO7DsSrb_qxbQZiIW6Oif_OnGQTePB3vZ-SS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjU0MjDRMzCPLzAAAEdEOOg"
content-security-policy: script-src 'report-sample' 'nonce-y-M06syrowNbYgA3dFnCfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 1675200226052423 Show response
connect.facebook.net/signals/config/ 98 KB
25 KB 257ms
257ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/1675200226052423?v=2.9.244&r=stable&domain=reurl.cc&hme=c8d728dcf66fcd6d2ba9e956bab53b4a2845b1d25a57eb74dd7839b3bf40323c&ex_m=90%2C149%2C129%2C19%2C66%2C67%2C122%2C62%2C42%2C123%2C71%2C61%2C9%2C136%2C79%2C14%2C89%2C27%2C117%2C110%2C69%2C72%2C116%2C133%2C98%2C138%2C7%2C3%2C4%2C6%2C5%2C2%2C80%2C88%2C139%2C217%2C160%2C56%2C219%2C220%2C49%2C175%2C26%2C68%2C225%2C224%2C163%2C29%2C55%2C8%2C58%2C84%2C85%2C86%2C91%2C113%2C28%2C25%2C115%2C112%2C111%2C130%2C70%2C132%2C131%2C44%2C54%2C106%2C13%2C135%2C39%2C205%2C208%2C170%2C22%2C23%2C24%2C16%2C17%2C38%2C34%2C36%2C35%2C75%2C81%2C83%2C96%2C121%2C124%2C40%2C97%2C20%2C18%2C102%2C63%2C32%2C126%2C125%2C127%2C118%2C21%2C31%2C53%2C95%2C134%2C64%2C15%2C128%2C30%2C185%2C156%2C281%2C203%2C147%2C188%2C181%2C157%2C93%2C114%2C74%2C104%2C48%2C41%2C103%2C109%2C52%2C59%2C108%2C43%2C99%2C47%2C50%2C46%2C87%2C137%2C0%2C107%2C12%2C105%2C10%2C1%2C51%2C82%2C57%2C60%2C101%2C78%2C77%2C45%2C119%2C76%2C73%2C65%2C100%2C92%2C37%2C120%2C33%2C94%2C11%2C140

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

cda69bc838ea763c9bdd1a55d3d400cf3135c70bff641395f707f48364d7e1e4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;script-src 'nonce-LCNeYbBs' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com;font-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;img-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;media-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;child-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;frame-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;manifest-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;object-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;worker-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;script-src 'nonce-LCNeYbBs' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;img-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;media-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;child-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;frame-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;manifest-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;object-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;worker-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=99, mss=1232, tbw=98210, tp=89, tpl=0, uplat=204, ullat=0
pragma: public
x-fb-debug: 6Ab33poETKMzGR2fP0+NdfFG020hyKU9YGmg8yZ1JRUuraYQKTWLyE7G7kxzTT7Xnwy3Y+IWVjaK3UREvilFrQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 211ms
65ms Script
text/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/asset/javascripts/common/ga.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
age: 5577
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Fri, 05 Dec 2025 20:49:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 18:49:44 GMT
last-modified: Tue, 15 Jul 2025 00:44:26 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20737
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
446 B 67ms
66ms XHR
text/plain 142.250.184.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j102&a=928928402&t=pageview&_s=1&dl=https%3A%2F%2Freurl.cc%2F4bojVj&ul=pl-pl&dt=Meilleur%20IPTV%20Abonnement%20en%20France&sr=1600x1200&vp=1600x1200&_u=IADAAEABAAAAACAAI~&jid=1865710918&gjid=1579641612&cid=1361717008.1764966161&tid=UA-102456694-1&_gid=1977214255.1764966161&_r=1&_slc=1&z=1189130008

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

report-to: {"group":"ascnsrsgac:211:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:211:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:41 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:211:0
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:211:0
content-length: 3
server: Golfe2

GET
H3 200 /
www.facebook.com/privacy_sandbox/topics/registration/ 67 B
0 216ms
158ms Fetch
image/png 157.240.253.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/privacy_sandbox/topics/registration/?id=1675200226052423

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/signals/config/1675200226052423?v=2.9.244&r=stable&domain=reurl.cc&hme=c8d728dcf66fcd6d2ba9e956bab53b4a2845b1d25a57eb74dd7839b3bf40323c&ex_m=90%2C149%2C129%2C19%2C66%2C67%2C122%2C62%2C42%2C123%2C71%2C61%2C9%2C136%2C79%2C14%2C89%2C27%2C117%2C110%2C69%2C72%2C116%2C133%2C98%2C138%2C7%2C3%2C4%2C6%2C5%2C2%2C80%2C88%2C139%2C217%2C160%2C56%2C219%2C220%2C49%2C175%2C26%2C68%2C225%2C224%2C163%2C29%2C55%2C8%2C58%2C84%2C85%2C86%2C91%2C113%2C28%2C25%2C115%2C112%2C111%2C130%2C70%2C132%2C131%2C44%2C54%2C106%2C13%2C135%2C39%2C205%2C208%2C170%2C22%2C23%2C24%2C16%2C17%2C38%2C34%2C36%2C35%2C75%2C81%2C83%2C96%2C121%2C124%2C40%2C97%2C20%2C18%2C102%2C63%2C32%2C126%2C125%2C127%2C118%2C21%2C31%2C53%2C95%2C134%2C64%2C15%2C128%2C30%2C185%2C156%2C281%2C203%2C147%2C188%2C181%2C157%2C93%2C114%2C74%2C104%2C48%2C41%2C103%2C109%2C52%2C59%2C108%2C43%2C99%2C47%2C50%2C46%2C87%2C137%2C0%2C107%2C12%2C105%2C10%2C1%2C51%2C82%2C57%2C60%2C101%2C78%2C77%2C45%2C119%2C76%2C73%2C65%2C100%2C92%2C37%2C120%2C33%2C94%2C11%2C140

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net 127.0.0.1: 'nonce-kfvCDyxD' blob: 'self' 'wasm-unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-expose-headers: X-FB-Debug, X-Loader-Length, X-Stack, Error-MID
content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7580471940068196849&cpp=C3&cv=1030694983&st=1764966161564"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
observe-browsing-topics: ?1
expires: Sat, 01 Jan 2000 00:00:00 GMT
access-control-allow-methods: OPTIONS
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: image/png
vary: Origin, Accept-Encoding
x-fb-debug: PBsUKmguvRoISADURgZf/b31Y/5+ge92lQhmN47Vnw2BLtUoisKOXJWvlp1iMn9NNdOiUKW6Ov4ENTyBA8fZEQ==
priority: u=1,i
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7580471940068196849&cpp=C3&cv=1030694983&st=1764966161564", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 127.0.0.1:* 'nonce-kfvCDyxD' blob: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=49, rtx=0, c=24, mss=1232, tbw=4968, tp=9, tpl=0, uplat=106, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: *
x-xss-protection: 0
origin-agent-cluster: ?1

GET error
connect.facebook.net//log/ 0
0

GET
H3 200 /
www.facebook.com/tr/ 0
18 B 115ms
54ms Image
text/plain 157.240.253.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1675200226052423&ev=PageView&dl=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&rl=&if=false&ts=1764966161421&sw=1600&sh=1200&v=2.9.244&r=stable&ec=0&o=12316&fbp=fb.1.1764966161420.701414630182911357&cs_est=true&ler=empty&cdl=API_unavailable&it=1764966161149&coo=false&expv2[0]=pl0&expv2[1]=el2&expv2[2]=bc1&expv2[3]=mr0&expv2[4]=ct0&rqm=GET

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=52, rtx=0, c=23, mss=1232, tbw=4744, tp=9, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
197 B 303ms
243ms Image
image/png 157.240.253.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1675200226052423&ev=PageView&dl=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&rl=&if=false&ts=1764966161421&sw=1600&sh=1200&v=2.9.244&r=stable&ec=0&o=12316&fbp=fb.1.1764966161420.701414630182911357&cs_est=true&ler=empty&cdl=API_unavailable&it=1764966161149&coo=false&expv2[0]=pl0&expv2[1]=el2&expv2[2]=bc1&expv2[3]=mr0&expv2[4]=ct0&rqm=FGET

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net 127.0.0.1: 'nonce-u3C53MzK' blob: 'self' 'wasm-unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7580471940229746559&cpp=C3&cv=1030694983&st=1764966161567"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: /DA1hPB2y0G+qrCklZtVP0RCIyX1yPfkT8tm+xNcT2KGVI2qGNNbQ94qWfB709LNR+6T1x6Y3zm04RR5RiHFDw==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7580471940229746559&cpp=C3&cv=1030694983&st=1764966161567", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 127.0.0.1:* 'nonce-u3C53MzK' blob: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=52, rtx=0, c=24, mss=1232, tbw=5384, tp=13, tpl=0, uplat=188, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame 0D46 46 B
228 B 423ms
325ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=pl-PL&ht=1764966161559&evtid=b0a0d343-cbb6-4b76-8bea-46ab26816561&tid=5&cid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 1e80a28383bfc03e89db5bac76e1ae460940a8349dd10009e43a71884f26647d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:41 GMT
x-cloud-trace-context: 05314f329d9e0bda51489507595d7b92
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame 1963 46 B
227 B 434ms
336ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=pl-PL&ht=1764966161561&evtid=d3e261dc-7e19-44a5-b20a-99e6abca2d41&tid=5&cid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: ca393d099e0df45caede45790fc97408a6d427576be3b80bedfccf9a1a71bd32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:41 GMT
x-cloud-trace-context: 91781bda9445ac8c51489507595d7d4c
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 did Show response
track.91app.io/ext/v1/ Frame 0D46 46 B
419 B 371ms
306ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 1fb03c2367e0610493a5a3e5234f92905c53ec3d8c9b858b3a9bcfe0d64da7bb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:41 GMT
x-cloud-trace-context: 1818490134fb3d3951489507595d708b
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame BBAB 46 B
227 B 385ms
325ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=pl-PL&ht=1764966161599&evtid=5df1d0e8-437e-4c08-8c50-2678a59f1d03&tid=5&cid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 35c0e60050b3d63cdb7514054aeef91b80f43862efa367e36c9423e827ada5c6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:41 GMT
x-cloud-trace-context: e57a2aa5dd983d4a51489507595d7968
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame 2103 46 B
227 B 396ms
337ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=pl-PL&ht=1764966161600&evtid=d082e957-ea98-4b46-8e03-aba4ac7dcd0b&tid=5&cid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 45b9d5d6bd09c3cb5bc66e810f5705296bd6c0131608772a1a9e59d34e3ccce1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:41 GMT
x-cloud-trace-context: 906381a9ad0e266d51489507595d7245
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame 2345 46 B
227 B 382ms
323ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=pl-PL&ht=1764966161600&evtid=60ac1d76-39f5-4462-af59-7de1e2170268&tid=5&cid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: a9e73e3bb6ae4b6ce48801d8c36b1fb23aabd6a0c84b1c2fec44a7d8119f9baa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:41 GMT
x-cloud-trace-context: d551e83ab0e3e43151489507595d7853
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 did Show response
track.91app.io/ext/v1/ Frame 1963 46 B
228 B 624ms
305ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: a2380272606f9124d05c4c5dbcd85a8988af81cd8c6197c5e5a57f27cd164f70

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:42 GMT
x-cloud-trace-context: 6e89fa97c313f6b651489507595d7bbb
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame BBAB 46 B
66 B 889ms
305ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: e08b04a6939040e0bf913ed4bf2c7c78e0dbeed2f1f559155638f5d26d487f64

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:42 GMT
x-cloud-trace-context: 66ce1a323f50e9ccd90a3c7649f8f305
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame 2103 46 B
66 B 1163ms
304ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: f425cd304d655b9c5d610769ceb94f478a3f6e5c0987a47271ee0299c0a42b22

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:42 GMT
x-cloud-trace-context: e4dfc6805773973cd90a3c7649f8f0ba
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame 2345 46 B
66 B 1432ms
305ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 2d01bab223123dda078936e64e792c2881faa503049973c1ccad05ba16a1738b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:43 GMT
x-cloud-trace-context: 640c52f847d83e90d90a3c7649f8ff63
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame DD2F 0
201 B 330ms
330ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=22213&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=63&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 94FF 2 KB
1 KB 301ms
301ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=13861&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=466&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 36ce58e725022c68db17f7afb3adfa7bc354822d0146e37c25be5680ec876cdf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame BD96 0
201 B 330ms
330ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=13860&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=186&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 9D5D 1 KB
853 B 309ms
308ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=13858&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=741&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a04a65eacad9ae6127a33e15a1d4308b270c88b706604c36be0febbed864f32d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame BC71 4 KB
2 KB 484ms
483ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=124&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3cb25639a350059fadd9a51748f340a0eda4200318f77c30a4d24e98e0224fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame BC71 3 KB
3 KB 65ms
64ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 26
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: KI8iU91guaL-XA3uKKVdi3UCcFoMfOtgRj1YDBPK40eVMvj97EFHKw==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame BC71 128 KB
46 KB 276ms
114ms Script
text/javascript 178.250.1.39
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.39 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

a809a621787685f33490a4f83b2d55092728abc4a3ea4feb8aec82619613d081

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: public, max-age=86400
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
expires: Sat, 06 Dec 2025 20:22:42 GMT
access-control-allow-origin: *
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/javascript
vary: x-geo-country, Accept-Encoding
server: Kestrel

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame BC71 3 KB
4 KB 93ms
92ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 26
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: Z_nfjlyLRHy2O1a9mvqayj7V9jiuBkyFJjFXZmGUD_EuqklyAvok3g==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame BC71 3 KB
4 KB 94ms
93ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 43
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: XNRkqQ8YFPYI8xKOrDXzP_M-nWCZw8XZbytrkozpq86yXr0M6HDyQA==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame BC71 5 KB
6 KB 92ms
91ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 26
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: i3IAuWWdNl84UvknUyxQ7CpLNfyeUNhFT7UbzAyrWf3f5sksJ6a2bQ==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 teads_mainV3.js Show response
cdn.holmesmind.com/js/ Frame BC71 46 KB
46 KB 91ms
91ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/teads_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6d4c444108925dc2ec8fe761f55a6760241c123740591e1348f0f94a653a3985

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: 0GyqAf7LKhNiqEjX8VRsAWlYH_I2gXHI
etag: "a7e4fcfdedcaf972df92c41e4c9dc6b0"
age: 26
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 46892
x-amz-cf-id: b1G8L0RdSjhXZ3QyLBFOaTYXHP_EHAaIxIMMhsPr14zHZAfIe6gU_Q==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Thu, 16 May 2024 06:07:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 ucfunnel.js Show response
cdn.holmesmind.com/js/ Frame BC71 2 KB
3 KB 92ms
92ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/ucfunnel.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6215cea030001547475bd19ec624e50c85af367309e115d7813ae4eaff664d32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: 7FnOHKe__pwg0dVwIyTfAcdImUIZ6pwv
etag: "8ebabc4e0b1d40fe52514166c7db7048"
age: 26
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2166
x-amz-cf-id: EHN570U7HZIe_gUUGDIzScCVU6iExm5M3uyo29qTuosxkwWhEbcEcA==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Fri, 21 Jul 2023 03:54:43 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 oid Show response
onead.onevision.com.tw/v2/et/ 371 B
1 KB 420ms
302ms Script
application/javascript 107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://onead.onevision.com.tw/v2/et/oid?cb=window.text_etag_callback_4kyyw

Requested by

Host: ad-specs.guoshipartners.com
URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

176.241.178.107.bc.googleusercontent.com

Software

gws / OneAD

Resource Hash

2324d5a73d13df21e0676fb0d47c8068386736a614dfb6230a0f4713b90397bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: 29cc6b37
etag: 26d460a6-d218-11f0-ab46-42010a00008f
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 301238940
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/javascript
last-modified: Fri, 05 Dec 2025 20:22:42 GMT
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=600
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 371
x-onead-backend: onead-http-event-c9tb-gohttp
server: gws
x-powered-by: OneAD

GET
H3 200 page.php Show response
www.facebook.com/plugins/ Frame 0F91 47 KB
14 KB 246ms
195ms Document
text/html 157.240.253.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

Resource Hash

ae34e3ebad4a87ef0e35c5a6b9ce15c05836f35ca05ef59d7fb1c59b181907b7

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-My4UqTPy' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: zstd
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-My4UqTPy' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none;report-to="coop_report"
cross-origin-resource-policy: cross-origin
date: Fri, 05 Dec 2025 20:22:42 GMT
document-policy: force-load-at-top include-js-call-stacks-in-crash-reports
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?1
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
pragma: no-cache
priority: u=0,i
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7580471940705389264&cpp=C3&cv=1030694983&st=1764966161961"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7580471940705389264&cpp=C3&cv=1030694983&st=1764966161961", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-connection-quality: GOOD; q=0.7, rtt=52, rtx=0, c=23, mss=1232, tbw=4966, tp=9, tpl=0, uplat=145, ullat=0
x-fb-debug: nM6DEEhk74BKcpSxkdgEp5T1tvNWZm2QxSQypft49TEXqecCm4McI38dh5FmGQD5mNIiwDDZ252AySOMDzRXTQ==
x-xss-protection: 0

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame BC71 0
171 B 835ms
400ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:42 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H/1.1 204
No Content prebid.aspx Show response
prebid.scupio.com/recweb/ Frame BC71 0
168 B 1419ms
674ms XHR
text/plain 210.59.219.34
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.6500887817283099
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 210.59.219.34 Taichung, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 210-59-219-34.hinet-ip.hinet.net
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

Access-Control-Allow-Origin: https://reurl.cc
Date: Fri, 05 Dec 2025 20:22:42 GMT
Server: Kestrel
Access-Control-Allow-Credentials: true

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame BC71
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=mh2DAsxXAyCEK1vhEz8zaQ

2 B
20 B

303ms
301ms

XHR
application/json

35.190.36.98
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=mh2DAsxXAyCEK1vhEz8zaQ
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H3
Server: 35.190.36.98 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=mh2DAsxXAyCEK1vhEz8zaQ
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 05 Dec 2025 20:22:43 GMT
Server: nginx

GET
H2 200 feeds Show response
re-news.tw/ 6 KB
3 KB 1006ms
482ms XHR
text/html 35.185.136.122
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://re-news.tw/feeds
Requested by: Host: reurl.cc
URL: https://reurl.cc/asset/javascripts/common/renews.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.185.136.122 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 122.136.185.35.bc.googleusercontent.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 35d3296d29f50d6719933c6e20d0830ef359a297952723fa080ccfda9fcdf912

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
etag: W/"16d2-pnyH4ln+QCWnFBi2dgdaeNFQUsY"
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: text/html; charset=utf-8
x-powered-by: Express
server: nginx/1.18.0 (Ubuntu)
vary: Origin

GET
H3 200 keywordCategories.json Show response
anymind360.com/ 148 KB
60 KB 159ms
80ms Fetch
application/json 151.101.65.55
FASTLY

General

Check archive.org

Download Go to

Full URL

https://anymind360.com/keywordCategories.json

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.65.55 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

9aa92a9a076fd2e55f339cd82c8b540e96ea0a4e4c7c12da6602edfadf2a0819

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-goog-metageneration: 2
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=hYq3+w==, md5=ZJdPIhH4R+FB2zz6x81gJg==
content-encoding: gzip
etag: "64974f2211f847e141db3cfac7cd6026"
age: 66652
x-goog-stored-content-encoding: identity
expires: Wed, 27 Aug 2025 11:36:24 GMT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-goog-stored-content-length: 151503
x-cache: HIT, HIT
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/json
last-modified: Wed, 27 Aug 2025 06:51:59 GMT
x-served-by: cache-tyo11981-TYO, cache-vie6349-VIE
x-cache-hits: 446788, 1352
x-guploader-uploadid: ABgVH8_WbYCDB2LaOxaydMbIBmzZEeTdmD__y3SdRPYQiipklanNaJ-DP_0DBH49PGWyFZEEI1nzUSM
strict-transport-security: max-age=31557600
vary: Accept-Encoding
cache-control: max-age=1200
x-goog-storage-class: STANDARD
x-timer: S1764966162.090816,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1756277519403323
content-length: 61163
server: UploadServer

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ 9 KB
0 1ms
1ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/asset/javascripts/common/clickforce_anchor.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ab187b70940d331c60646d5731fa8e86d6958ba69dfa241361e39d30d81c2d31

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: PKBfBRh_ckEc5dxIcFkl8Hvvqrcpi_Dy
etag: "daceea64521f6f981e4b58edc119028a"
age: 45
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9646
x-amz-cf-id: kQOHbxgXCWiw6KoWGuXzivCEpX9CrwhEoXlcoOEFkiT3m_KazEYg7g==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Fri, 09 May 2025 03:01:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 139ms
78ms Fetch
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512020101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame DD2F 5 KB
3 KB 1413ms
676ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 05 Dec 2025 20:32:43 GMT
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 94FF 5 KB
0 1413ms
1413ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 05 Dec 2025 20:32:43 GMT
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame BD96 5 KB
0 1412ms
1412ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 05 Dec 2025 20:32:43 GMT
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 9D5D 5 KB
0 1412ms
1412ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 05 Dec 2025 20:32:43 GMT
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame BC71 5 KB
0 1412ms
1412ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 05 Dec 2025 20:32:43 GMT
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 0D46 332 KB
87 KB 110ms
54ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

eff958d6a66dede8a64c252dcf84e69d34c888460d5fcf6f835e655ab487d352

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-kRLP7T2G' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-kRLP7T2G' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=4967, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: n9NCX0Qo9s6D3uiA0rimFqs7y4e5TA96pubqlvSKiLyByoV1Ct0j74QY3edQ11ON2lJ+iCh+TsgHVn88NnVEog==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 88493
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 1807 3 KB
1 KB 551ms
551ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=18535&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=848&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: fe1bcebb6fc407517010ed86454b1845d11f42d29b921dc365058d52a498fa3d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET cm
ad.holmesmind.com/adserver/ Frame 0D46 0
0

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame 2EA6 12 KB
12 KB 789ms
788ms Document
text/html 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-length: 12184
content-type: text/html
date: Fri, 05 Dec 2025 20:22:43 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 c8441ee313b5204aa32e9bf5a370d536.cloudfront.net (CloudFront)
x-amz-cf-id: WGVvFQU3Jrnza-jRZiUdelCpBlLxT0xeYV08agJ_3OvV7pEuXS9apA==
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: RefreshHit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame D992 11 KB
0 0ms
0ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: qBmZmL891DJ0nM0tgLDrbpha1KGsWhy3Flg5L-liXjIpD0nG9CbQBQ==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 182E 11 KB
0 0ms
0ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: qBmZmL891DJ0nM0tgLDrbpha1KGsWhy3Flg5L-liXjIpD0nG9CbQBQ==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame D992 7 KB
1 KB 508ms
506ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=22214
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d867626032b0bd239f90051d884f30405a037456f9d81d8ffb20781dc98b5fde

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame D992 30 KB
0 0ms
0ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: S4C-P7xkUW14QviCzPQXqMKaoB9QSuZ-acktnPX_PCr7pu5JdHy4Pg==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 182E 7 KB
1 KB 478ms
476ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14209
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 68feb2e00f000a42974febaa88dd61de1e5f876912eff189479c9c26d1ca8b90

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 182E 30 KB
0 1ms
1ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 44
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: S4C-P7xkUW14QviCzPQXqMKaoB9QSuZ-acktnPX_PCr7pu5JdHy4Pg==
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 94FF 13 KB
13 KB 59ms
58ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=13861&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=466&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 21
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: sVl61sJ5OMdZbsXBirafzD8UINUHcFCAT_MbkxqqZM5wMq1ziAzWAA==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 9D5D 13 KB
0 59ms
59ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=13858&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=741&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 21
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: sVl61sJ5OMdZbsXBirafzD8UINUHcFCAT_MbkxqqZM5wMq1ziAzWAA==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H3 200 iXGJEr7Orjl.css
static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/ Frame 0F91 20 KB
6 KB 119ms
55ms Stylesheet
text/css 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/iXGJEr7Orjl.css

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

60280ebcf60053f7d378a772ecfabb60b0b69b9634e19105cb2307b126918447

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: z/mgktkHqyjk5kjdOFxmUA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 04 Dec 2026 02:38:01 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: IRgivbYnQcEPRwHRU7Uj1G6aG31bINKacwkmWQaQDbqVz9b1yQdoyWFeKvbACuXX/T5J1RRkedhgeTZV5c06uA==
priority: u=0
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=5208, tp=14, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 5633
origin-agent-cluster: ?1

GET
H3 200 gRrpj66Y7tz.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yp/r/ Frame 0F91 339 KB
90 KB 119ms
56ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yp/r/gRrpj66Y7tz.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

6f02119b53d02d3c5d1785f81818a184f07ae539610c5c3e7a45250b49bbcd65

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: 4K3LTE7XDMoIXX+fIJbnEg==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 03 Dec 2026 08:12:42 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: NgQ+9hMbJv3wuQzr8Gs7cU5W9aU75DfZshCHk91wzAsKIUwptgzwXnTSjsnVQJcaYD2XJRExH0p8ECNv77a5qA==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=5208, tp=14, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 92037
origin-agent-cluster: ?1

GET
H3 200 XZtOE_fK9iK.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yK/r/ Frame 0F91 8 KB
3 KB 232ms
169ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yK/r/XZtOE_fK9iK.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

8f7636a0b0dd99d49730dd0dd8f91db5bc76ead8b17b834c2071fdeac92ce0f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: PSFvzQDInesB10SfR39pWA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 03 Dec 2026 10:20:41 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: TiAOkyok4Gtmt6TslD5TrM0F+8KW9Dcqpx5TEkf5f4ezKqcRv7LxZfpdYwlYrrJpK/mye6Kkncbbp4B7hroE+w==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=6904, tp=16, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 2665
origin-agent-cluster: ?1

GET
H3 200 vdIZbO1p2dQ.js Show response
static.xx.fbcdn.net/rsrc.php/v4iEpO4/yY/l/pl_PL-j/ Frame 0F91 185 KB
50 KB 234ms
170ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4iEpO4/yY/l/pl_PL-j/vdIZbO1p2dQ.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

eedbdad9864da701eda6a0b8472480cfc4050659a674e0336142cf075d198ccb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: dLgjlD30WG41RBLmQr8mFg==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 03 Dec 2026 21:27:17 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: fVhVTNjsIKdsFLKj0dLbVGmqOtr5WW6m7b19faCVvHQjEMfWOqA1xVkmtQ7oAxJAfjaboIO+IFqatK/Q3aqlww==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=34008, tp=38, tpl=0, uplat=4, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 50892
origin-agent-cluster: ?1

GET
H3 200 yCxG4O5SlL8.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yH/r/ Frame 0F91 38 KB
13 KB 246ms
183ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yH/r/yCxG4O5SlL8.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

57d8d192e38209cc36c358984a2edd8682971c9437188459d4a7bd22b1f1813e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: i4RjKirexDZEvr3zBviN+A==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 03 Dec 2026 16:04:08 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: rQifCpqRSyhQNBGOYI1Eefeoxv1Sek0cKRKYzXRCBpIsaSD1Tkrc5gJRdliCAawzb9Tw7+91x0cW8VhYnLp0Tw==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=6904, tp=16, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-fb-optimizer: 0
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 12736
origin-agent-cluster: ?1

GET
H3 200 8wypiAW_bfk.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yb/r/ Frame 0F91 557 B
465 B 249ms
186ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yb/r/8wypiAW_bfk.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

c2bfe20d9d58935828e75bc753e2655f240621077408ae64f9b40a20f5125487

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: WrWgdG79ReerxOLSJDvtvA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 04 Dec 2026 01:55:58 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: oiyejPcVDxE6Rl5D30OBERe7L3keGO+G0qbXRnyGbXYkOlLfviZrzQIv2E7eLQ8rQG3283qhhz5pA6VXIzHJ8w==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=25384, tp=31, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 323
origin-agent-cluster: ?1

GET
H3 200 2v2nU1TtjgO.js Show response
static.xx.fbcdn.net/rsrc.php/v4iLl54/yj/l/pl_PL-j/ Frame 0F91 30 KB
9 KB 249ms
186ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4iLl54/yj/l/pl_PL-j/2v2nU1TtjgO.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

e325b081132e5ef6099df35494e9abcf692301f37359daeaedb7849435fc23c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: cfEflR2Gr3512h+1S/+woA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 02 Dec 2026 20:34:43 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: BI2lBTN1PdDnOrZMZTYUFfdEJSJbirGOozWkS7doi6djvrhjqE+cK3pUhuTqmxa0gm5PiYyp9m7a98S++EwWLw==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=34008, tp=38, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 8795
origin-agent-cluster: ?1

GET
H3 200 302181889_449668210518240_1343224774275673253_n.png
scontent.xx.fbcdn.net/v/t39.30808-1/ Frame 0F91 2 KB
2 KB 60ms
54ms Image
image/png 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL: https://scontent.xx.fbcdn.net/v/t39.30808-1/302181889_449668210518240_1343224774275673253_n.png?stp=cp0_dst-png_s50x50&_nc_cat=105&ccb=1-7&_nc_sid=f907e8&_nc_ohc=qfWTQ7ztsugQ7kNvwFgkMMB&_nc_oc=AdktDmVuASHjy6x8p-SblaROY7B4BhU3jnB6Wx2VhgwVz00FsSd_75tTa-czJqDyr34&_nc_zt=24&_nc_ht=scontent.xx&edm=ADwHzz8EAAAA&_nc_gid=ws71-bMY4eeVFKdkQ7qSnQ&oh=00_AfnxyrsWw7Y0QeLsemPc-w7UPVADCJG_IC2naMFMEsS1DQ&oe=69390C15
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS: xx-fbcdn-shv-02-fra5.fbcdn.net
Software: /
Resource Hash: 352d0915216b13b935f1abedea04d4a039802faaf69153ae71c377410990e322

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.facebook.com/

Response headers

x-robots-tag: noarchive, noindex
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
no-vary-search: key-order, params=("_nc_gid" "oh" "oe" "_nc_oc" "_nc_ohc" "_nc_cat" "_nc_ht" "_nc_cb")
last-modified: Tue, 06 Sep 2022 22:20:57 GMT
x-fb-ptm-uuid: 764C2806C9CAF66720C92F85FA8CB99B
content-type: image/png
priority: u=3,i
cache-control: max-age=1209600, no-transform
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=99, mss=1232, tbw=98554, tp=90, tpl=0, uplat=0, ullat=-1
x-crypto-project: 0
cross-origin-resource-policy: cross-origin
content-digest: adler32=747767112
access-control-allow-origin: *
accept-ranges: bytes
content-length: 2066
x-additional-error-detail

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 0D46 37 B
408 B 648ms
647ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

f1d5f46a83573232e102e008949b96e936bcb4b95b9a0992e095b568b8951683

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://cdn.holmesmind.com
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 1807 5 KB
0 1208ms
1208ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 05 Dec 2025 20:32:43 GMT
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 adsrv Show response
onead.onevision.com.tw/v2/ 176 B
476 B 323ms
322ms Script
application/javascript 107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://onead.onevision.com.tw/v2/adsrv?version=20250516&uid=1000480&category=-1&cookie=true&ip=&guid=26d460bc-d218-11f0-ab46-42010a00008f&channel=0&volume=0.5&r=&adid=&response_freq_multiple=native-drive.0&web_location=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&title=Meilleur%20IPTV%20Abonnement%20en%20France&fp=5618cb3bd5b3469d7b1a7fa461937af7&_t=1764966162249&cb=ONEAD_text_response_4kyyw&pb=0&spid=&player_type=NATIVE_LIST&bgid=0

Requested by

Host: ad-specs.guoshipartners.com
URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

176.241.178.107.bc.googleusercontent.com

Software

gws / OneAD

Resource Hash

aca35582942ff81da0f14188ec61af389d37ebe2a7c29c6145e53a9f885bec55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: 29cc6b37
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 97200986
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/javascript
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-onead-guid: 26d460bc-d218-11f0-ab46-42010a00008f
x-onead-force-backend: false
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 176
x-onead-hit-counter: 1
x-onead-backend: onead-http-query-7g9c-gohttp
server: gws
x-powered-by: OneAD

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame BC71 13 KB
0 0ms
0ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=124&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 21
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: sVl61sJ5OMdZbsXBirafzD8UINUHcFCAT_MbkxqqZM5wMq1ziAzWAA==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H3 200 UXtr_j2Fwe-.png
static.xx.fbcdn.net/rsrc.php/v4/yw/r/ Frame 0F91 573 B
716 B 52ms
52ms Image
image/png 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yw/r/UXtr_j2Fwe-.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/iXGJEr7Orjl.css

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

96e3e8dfde6b1042514824bac1b44282d4a76bac028f2d767f6534dce2cf3db0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/iXGJEr7Orjl.css

Response headers

content-md5: 07aG/2AEtDHVAZ5LUajMDQ==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 03 Dec 2026 19:10:55 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: image/png
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: /yeInbSqMPtkmaV1euSisMkHJoXHCecJJHQaqWTFbRaklmKrdS0j2dEELYttByqjgCxJ+cI7JuwZ3j2lwn77kQ==
priority: u=3,i
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: UNKNOWN; q=-1, rtt=-1, rtx=0, c=20, mss=1232, tbw=2333, tp=5, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-fb-optimizer: 0
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: *
content-length: 573
origin-agent-cluster: ?1

GET cm
ad.holmesmind.com/adserver/ Frame 1963 0
0

GET
H3 200 yOHGSiPxtnZ.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yQ/r/ Frame 0F91 241 KB
68 KB 54ms
54ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yQ/r/yOHGSiPxtnZ.js

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yp/r/gRrpj66Y7tz.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

d50cad871cd252aca6f998215c8f1c3d372bef86a324e45fc1f60d0b5e1e61b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: ckYjKnync6z+PRlu4g5ckg==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 05 Dec 2026 16:32:15 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: OKbtBJG0kSxP4NJmIFslBhzmMkoWi7S253cFdA4l56wCEawoI/c16B/5jsx09gb4RAyQ+tpSVxULplbNh9Y8nw==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=165, mss=1232, tbw=184888, tp=164, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 69106
origin-agent-cluster: ?1

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 1963 332 KB
0 0ms
0ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

eff958d6a66dede8a64c252dcf84e69d34c888460d5fcf6f835e655ab487d352

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-kRLP7T2G' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-kRLP7T2G' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=4967, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: n9NCX0Qo9s6D3uiA0rimFqs7y4e5TA96pubqlvSKiLyByoV1Ct0j74QY3edQ11ON2lJ+iCh+TsgHVn88NnVEog==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 88493
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 / Show response
www.facebook.com/platform/plugin/tab/renderer/ Frame 0F91 69 KB
18 KB 330ms
330ms XHR
application/x-javascript 157.240.253.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%22776730922422337%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F%22%2C%22width%22%3A340%2C%22height%22%3A500%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Afalse%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Afalse%2C%22referer_uri%22%3A%22https%3A%2F%2Freurl.cc%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__req=1&__hs=20427.BP%3Aplugin_default_pkg.2.0...0&dpr=1&__ccg=EXCELLENT&__rev=1030694983&__s=%3A%3A0d6rm0&__hsi=7580471940705389264&__dyn=7wKxa13wt8K2Wmh0Sw8W5U4e1Fx-ewpU3WwvE3vx609vCwjE0AC1xwEw7Bx61vw5zw78w5Uw64w8W1uw2oE17U2ZwrU1Xo1UU3jwea&__sp=1

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4iEpO4/yY/l/pl_PL-j/vdIZbO1p2dQ.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

Resource Hash

ddc8b32cf4e328a8b39ea4149387ade5384e622d658fc780042c3a755a00e0d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-ASBD-ID: 359341
X-FB-LSD: aBReG002I7fcQgFSa9CcjW
Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7580471944489573231&cpp=C3&cv=1030694983&st=1764966162550"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
x-fb-debug: mHbvDk/lSoSqYXqzzzowFGNHhY5dhBJsL7pEik25xYqplPSSeYFb3vxnz9JytNNyzw8ELTg7lARua+cYESUvSA==
priority: u=1,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7580471944489573231&cpp=C3&cv=1030694983&st=1764966162550", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
cache-control: private, no-cache, no-store, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=52, rtx=0, c=40, mss=1232, tbw=27046, tp=37, tpl=0, uplat=280, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
origin-agent-cluster: ?1

POST
H3 200 / Show response
www.facebook.com/platform/plugin/page/logging/ Frame 0F91 1021 B
726 B 164ms
163ms XHR
application/x-javascript 157.240.253.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/platform/plugin/page/logging/

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4iEpO4/yY/l/pl_PL-j/vdIZbO1p2dQ.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

Resource Hash

df654baaa62745cddc3a03e7c835de7a31eae3c3e75b9ed4cfcfa446c994b064

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-ASBD-ID: 359341
X-FB-LSD: aBReG002I7fcQgFSa9CcjW
Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-expose-headers: X-FB-Debug, X-Loader-Length, X-Stack, Error-MID
content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7580471945575992904&cpp=C3&cv=1030694983&st=1764966162562"}]}
x-content-type-options: nosniff
access-control-allow-methods: OPTIONS
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
vary: Origin, Accept-Encoding
x-fb-debug: KWYkgyBMFlD9hslnANQ6sHbv9vku19N7bLvNxKJJnHVHJAWD3eBGfK/VS5BFTJZk0ln2P55ZKj/QAwqwLLRyhQ==
priority: u=1,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7580471945575992904&cpp=C3&cv=1030694983&st=1764966162562"
cache-control: private, no-cache, no-store, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=52, rtx=0, c=40, mss=1232, tbw=25606, tp=33, tpl=0, uplat=113, ullat=1
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?1

GET
H3 200 xgVgalBG80z.png
static.xx.fbcdn.net/rsrc.php/v4/yH/r/ Frame 0F91 1 KB
1 KB 51ms
50ms Image
image/png 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yH/r/xgVgalBG80z.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/iXGJEr7Orjl.css

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

45444d590a67d30e8b2fde01bb6482f829383b64bf14a4b19b86e22fdc319fbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/iXGJEr7Orjl.css

Response headers

content-md5: rB4cTW8WNZcBsFntToJGtA==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 04 Dec 2026 16:29:17 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: image/png
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: ywtdQgM6cqhAGGJlVRW571z/sAB3MRklN5lBWttx56+8fP/GBEFNzXjD8PZEnx+1yJWHFoPRFsPLvU5qBA2KjQ==
priority: u=3,i
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=52, rtx=0, c=23, mss=1232, tbw=4868, tp=12, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: *
content-length: 1315
origin-agent-cluster: ?1

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 182E 0
201 B 337ms
331ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14209&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=580&o=4&fc=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame 182E 3 KB
0 1ms
1ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 26
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: KI8iU91guaL-XA3uKKVdi3UCcFoMfOtgRj1YDBPK40eVMvj97EFHKw==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame 182E 128 KB
0 1ms
1ms Script
text/javascript 178.250.1.39
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.1.39 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),
Reverse DNS
Software: Kestrel /
Resource Hash: a809a621787685f33490a4f83b2d55092728abc4a3ea4feb8aec82619613d081

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: public, max-age=86400
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
expires: Sat, 06 Dec 2025 20:22:42 GMT
access-control-allow-origin: *
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: text/javascript
vary: x-geo-country, Accept-Encoding
server: Kestrel

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame 182E 3 KB
0 3ms
3ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 26
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: Z_nfjlyLRHy2O1a9mvqayj7V9jiuBkyFJjFXZmGUD_EuqklyAvok3g==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame 182E 3 KB
0 3ms
3ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 43
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: XNRkqQ8YFPYI8xKOrDXzP_M-nWCZw8XZbytrkozpq86yXr0M6HDyQA==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame 182E 3 KB
4 KB 90ms
85ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: L_ytFJI.iZbA3Ys9mJ75ciLmXqmRfuVO
etag: "21253aa5d7ee0c3b700ce5f1a4a1b4d1"
age: 56
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3446
x-amz-cf-id: kuXJaDyeACNaK1FOT2KSs3lpWYfzTd--_l53eT8gnBunFmVp2E5-OA==
date: Fri, 05 Dec 2025 20:21:47 GMT
content-type: application/javascript
last-modified: Thu, 14 Dec 2023 06:52:43 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame 182E 5 KB
0 4ms
4ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 26
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: i3IAuWWdNl84UvknUyxQ7CpLNfyeUNhFT7UbzAyrWf3f5sksJ6a2bQ==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 prebid_mainV3.js Show response
cdn.holmesmind.com/js/ Frame 182E 3 KB
4 KB 846ms
841ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/prebid_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 979da208bbb4e7e775544f9ea351afe3cae32b74ca9b980e05762c5b0533fe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: qFW_bhDMYXaROfK7pGZd0YtcGDNChS4b
etag: "3a64d41cf3ddc5d6b7a060ad46bee403"
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 3414
x-amz-cf-id: zXEIbvnl3btFL_aKvi5Wr3HcU65F2N8qKbazOlYE6J0ZX6W76zU6EA==
date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: application/javascript
last-modified: Fri, 14 Jul 2023 03:27:51 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 182E
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=uVJMaseDBT2VqEeDEz8zaQ

2 B
20 B

301ms
300ms

XHR
application/json

35.190.36.98
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=uVJMaseDBT2VqEeDEz8zaQ
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H3
Server: 35.190.36.98 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=uVJMaseDBT2VqEeDEz8zaQ
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 05 Dec 2025 20:22:43 GMT
Server: nginx

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 182E
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=xFLGMdUJDqW3WyBrEz8zaQ

2 B
20 B

303ms
302ms

XHR
application/json

35.190.36.98
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=xFLGMdUJDqW3WyBrEz8zaQ
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H3
Server: 35.190.36.98 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=xFLGMdUJDqW3WyBrEz8zaQ
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 05 Dec 2025 20:22:43 GMT
Server: nginx

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame D992 4 KB
2 KB 589ms
589ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=22214&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=179&o=4&fc=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f984e83b815eba00d303bff671d57c7d2b183b6372a88bdd7c80ed8f57108dc5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 1807 13 KB
0 0ms
0ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=18535&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=848&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 21
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: sVl61sJ5OMdZbsXBirafzD8UINUHcFCAT_MbkxqqZM5wMq1ziAzWAA==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 f.js Show response
cdn.holmesmind.com/js/ Frame 1807 12 KB
12 KB 816ms
816ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/f.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=18535&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=848&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f8bcd058a4fbee6f8b68a5ff2930470c1890fc714914c226cf950b4e11ffdcdb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: I0L11em9y2rEWUbgZZxQXYLhoIMX8Pv6
etag: "1d98c42a6ebd67d5137147fbb5ad912f"
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 12254
x-amz-cf-id: xnqR9xR_925vkicrh3aTj5MFITZxdyxXF0lUKjwRCPMvPlgb6zd1Rg==
date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: application/javascript
last-modified: Fri, 14 Jun 2024 08:45:07 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H3

200

ltm
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://bcp.crwdcntrl.net/map/c=15135/tp=ONEA/lac=y?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id}
https://onead.onevision.com.tw/v2/pixel/ltm?id=

170 B
202 B

304ms
304ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://onead.onevision.com.tw/v2/pixel/ltm?id=

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

176.241.178.107.bc.googleusercontent.com

Software

gws / OneAD

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: 29cc6b37
x-vendor: ltm
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 144439189
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-h8d6-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
location: https://onead.onevision.com.tw/v2/pixel/ltm?id=
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 05 Dec 2025 20:22:42 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
149 B 644ms
324ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=r1jlltl&ttd_tpi=1
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-length: 70
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: image/gif
server: Kestrel

GET
H/1.1 200
OK pixel
ps.eyeota.net/ 0
354 B 262ms
56ms Image
text/plain 18.184.216.10
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/pixel?pid=3m51m51&uid=26d460bc-d218-11f0-ab46-42010a00008f&t=ajs
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.184.216.10 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-216-10.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Content-Length: 0
Date: Fri, 05 Dec 2025 20:22:42 GMT
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H3

200

taboola
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://trc.taboola.com/sg/onedata/1/cm
https://onead.onevision.com.tw/v2/pixel/taboola?id=b968a6b7-b1d4-4ef3-ba85-b0575aa4c23c-tuct102cc492

170 B
203 B

305ms
303ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://onead.onevision.com.tw/v2/pixel/taboola?id=b968a6b7-b1d4-4ef3-ba85-b0575aa4c23c-tuct102cc492

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

176.241.178.107.bc.googleusercontent.com

Software

gws / OneAD

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: 29cc6b37
x-vendor: taboola
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 291629334
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: b968a6b7-b1d4-4ef3-ba85-b0575aa4c23c-tuct102cc492
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-c9tb-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

x-fastly-to-nlb-rtt: 76784
location: https://onead.onevision.com.tw/v2/pixel/taboola?id=b968a6b7-b1d4-4ef3-ba85-b0575aa4c23c-tuct102cc492
x-timer: S1764966163.748827,VS0,VE78
x-vcl-time-ms: 78
via: 1.1 varnish
accept-ranges: bytes
x-cache: MISS
content-length: 0
date: Fri, 05 Dec 2025 20:22:42 GMT
x-service-version: v1
server: nginx
x-cache-hits: 0
x-served-by: cache-vie6322-VIE

GET cm
ad.holmesmind.com/adserver/ Frame BBAB 0
0

GET
H3 200 6tpzuzEODHB.js Show response
static.xx.fbcdn.net/rsrc.php/v4/y8/r/ Frame 0F91 213 B
353 B 55ms
54ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/y8/r/6tpzuzEODHB.js

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yp/r/gRrpj66Y7tz.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

f21233ebfc628748be56e544ee831e6723e5534227b3d48b06b77a7bda1f6e28

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: Cz7JW2XPt8zqYMcsXYdDQg==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 03 Dec 2026 22:00:06 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: SXSoD4qVVVcRy5lM/xpdCEQPuHDt0N9K2YxqEsxCMkyv04L4GawdLqI83+CT84WQYxk1m99Mv4x9rgGeTjU0jA==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=52, rtx=0, c=194, mss=1232, tbw=255784, tp=225, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 213
origin-agent-cluster: ?1

GET
H3 400 / Show response
www.facebook.com/login/ Frame 0F91 179 KB
179 KB 169ms
169ms Document
text/html 157.240.253.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fhref%3Dhttps%253A%252F%252Fwww.facebook.com%252Freurl.cc%252F%26tabs%3Dtimeline%26width%3D340%26height%3D500%26small_header%3Dfalse%26adapt_container_width%3Dtrue%26hide_cover%3Dfalse%26show_facepile%3Dtrue%26appId

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yp/r/gRrpj66Y7tz.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

Resource Hash

ca0aeb2fa960412185179c8973a01406d9fa3d180da741b13df4b4f5406f11fe

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net 127.0.0.1: 'nonce-BtxIEb3b' blob: 'self' 'wasm-unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: zstd
content-length: 854
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 127.0.0.1:* 'nonce-BtxIEb3b' blob: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
date: Fri, 05 Dec 2025 20:22:42 GMT
document-policy: include-js-call-stacks-in-crash-reports
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?1
pragma: no-cache
priority: u=0,i
proxy-status: http_request_error; e_fb_vipaddr="AcPr-vkbyxG7_WFZ3RV3deNgLNS7_Kcn64QGdYx_ZVn2_-SSfZwysxWjrSQDb0zH6oH0hTGM4NzWHOX5Ek-RCI4fE7UUl6I5M8gwsA"; e_clientaddr="AcN_Y7uiJ3XipaIvDREdhC-26Xuwwr6kLur1tMB2i45bbQL2FTIIsh1-OJ8ATtaGRSKBfx2ilHPww_2m3c46ps-tfTEI4O3SVWWH_ENSaNHBrhbMeA"; e_upip="AcN7m1uzcKy3BKYzYd1XEglC_c7W36-o6L4AVnTpxmX-doryM70tj6vjvLgyY_Q11OgWXENf8xDqcpYdvQnbw4LqUWook_9yE_2HDM46yyo"; e_fb_zone="AcNQAltm2w2aIe0v4k5-gAuagDlJ1hQLdoXulPUK-YTB4bhwoitel5BpNYbL5BsH"; e_fb_twtaskhandle="AcPbWcjXSFQWHhklkg7AicuvuwUiaWqhqVGX5BMGm-xAVdaGPC2vvSlOGPw0TRcP1SvE5gbo2o6Wl9HvGOuvkqg1kZiTIPfy-4Hfl9hsn6yWD4Q"; e_proxy="AcMEbyL_ukiTLIz51XXSqoipUlc_U95bik-QCnVFR0xGKN4qDs6W7VLcwEyM0TCl1EX75XU7LDirru8EDyct", http_request_error; e_fb_vipaddr="AcOh5fxbcDXbYA6rmUWu5d1fjQUEy4jqYgoDE-i05DCWCRIlbjUL8nVu_doLskcI3_oHzQPQ6OU"; e_clientaddr="AcNgGOZ1T2fs0PaMGybVW7oUk_u5LZMFVcxwDBgaARE9kLuPnze-z2ehbDMXIna4dO6ucXgIrsG-0a_g"; e_upip="AcORvdavi1HzDpqXHxto7lCAuNu3xx93luxgB52pHrPkJ2qR0XPiUvWw831d7GuQvtW1k21ukhcKYZuZ6EglnVwfTmL834XUEVAyDA"; e_fb_zone="AcO5nPIXV73P97m9uvq1ENy3boEUgWRbv7IXCNpR8GJiNuI3M7PbPwYNyulNoA"; e_fb_twtaskhandle="AcOfkgMt5mxVkc2TpSBpEZz_oT0owDx3ctLmSiYUtCjpDcSd_C4uwDEoh8gtXb2feeSZAbQDza9Ss7Fkbz0NWeg2iwfvoKXaELA"; e_proxy="AcMg9F5-4sdP74agYlr4VeVmIraO12G_TVRmXEW5kLQnhXBLs6ZIJW46gVzgTD9nNgGFKB97fY3Ayds"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7580471944637447365&cpp=C3&cv=1030694983&st=1764966162786"}]}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7580471944637447365&cpp=C3&cv=1030694983&st=1764966162786"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-connection-quality: GOOD; q=0.7, rtt=50, rtx=0, c=40, mss=1232, tbw=46518, tp=54, tpl=0, uplat=118, ullat=0
x-fb-debug: oSHt59u4CKKIkxxyUoskaGL7/gwY3s23NInyhJDU5dp+10wmowif+hTJY0U7/U0w7h1YLKIDh6945OQrAd0OiQ==
x-frame-options: DENY
x-xss-protection: 0

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 182E 5 KB
0 651ms
651ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 05 Dec 2025 20:32:43 GMT
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 2345 332 KB
0 0ms
0ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

eff958d6a66dede8a64c252dcf84e69d34c888460d5fcf6f835e655ab487d352

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-kRLP7T2G' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-kRLP7T2G' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=4967, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: n9NCX0Qo9s6D3uiA0rimFqs7y4e5TA96pubqlvSKiLyByoV1Ct0j74QY3edQ11ON2lJ+iCh+TsgHVn88NnVEog==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 88493
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 0D46 0
194 B 465ms
465ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=cf&cid=undefined

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://cdn.holmesmind.com
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame D992 5 KB
0 651ms
651ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 05 Dec 2025 20:32:43 GMT
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 94C9 105 KB
0 0ms
0ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

942be2506062746af49ca904cb7cfb0525cf8f0458f26b150beccfd5c76f1abf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 781 / 20427 / m202512020101 / config-hash: 5063855111797697403
x-content-type-options: nosniff
expires: Fri, 05 Dec 2025 20:22:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34189
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512020101/ Frame 94C9 609 KB
0 0ms
0ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512020101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

cdf207042b9030c6e625d7042dac68355209cda211f30a59d25b2b4baafd8c1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 10021983320797522262
age: 11497
x-content-type-options: nosniff
expires: Sat, 05 Dec 2026 17:11:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 05 Dec 2025 17:11:03 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 197115
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202512040101/ Frame 94C9 64 KB
0 0ms
0ms Other
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202512040101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

8d23693251d0923a21dba7083e1e3a58a18123b146cebbcefb828e1caa7c3aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 4740477158928784528
age: 15673
x-content-type-options: nosniff
expires: Fri, 12 Dec 2025 16:01:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 05 Dec 2025 16:01:27 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 22756
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202512040101"

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame 2EA6 42 KB
0 0ms
0ms Script
application/javascript 18.66.122.42
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-42.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0f390ce52e359572f07f6a2fb047858bdbdea327f0049589d71f6f31fd48d7f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: gzip
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 147
via: 1.1 db1cc9ceb7681bf2a56c0f22acac3a36.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: Rla2RO8xy1IFEe4PJ-5Ng9JIAuqv6OpTt053L4Yz6LfjXoZPVhAX8Q==
date: Fri, 05 Dec 2025 20:20:18 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK /
cm.lndata.com/ Frame 2EA6 35 B
470 B 255ms
255ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

Content-Length: 35
P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Date: Fri, 05 Dec 2025 20:22:42 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Connection: keep-alive
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame 2EA6 0
217 B 367ms
366ms Image
text/html 35.75.149.212
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp?fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.149.212 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-149-212.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3 200 cm
c.holmesmind.com/ Frame 2EA6 0
14 B 310ms
309ms Image
text/html 35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame 2EA6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uu_m=undefined
https://m.holmesmind.com/ml/google?cf_uid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uu_m=undefined&google_error=1

0
150 B

289ms
288ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uu_m=undefined&google_error=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Fri, 05 Dec 2025 21:22:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOFg708MvSTb3MKqz5GnCgFOXnUudGD1YpoXxa21Y2tBMQJsZNgEFMB-jyCLNJV3_2k6fq96R7c
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uu_m=undefined&google_error=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
date: Fri, 05 Dec 2025 20:22:42 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET Ubb04fKqLUX.css
static.xx.fbcdn.net/rsrc.php/v5/yd/l/0,cross/ Frame 0F91 0
0

GET
DATA 200
OK truncated
/ Frame 0F91 1 KB
0 Stylesheet
text/css

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1c1642a7b402e888a16272cd16de45afc68b34c918aed03cbcbce55d74f21a2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

Content-Type: text/css;charset=utf-8

GET oArmeD_dMWe.js
static.xx.fbcdn.net/rsrc.php/v4/yi/r/ Frame 0F91 0
0

GET IBMxsyOas0F.js
static.xx.fbcdn.net/rsrc.php/v4/y2/r/ Frame 0F91 0
0

GET atv-3qMDl2i.js
static.xx.fbcdn.net/rsrc.php/v4/yd/r/ Frame 0F91 0
0

GET jTXziHT_cAS.js
static.xx.fbcdn.net/rsrc.php/v4izx64/y9/l/pl_PL-j/ Frame 0F91 0
0

GET v_kkAv_-wGQ.js
static.xx.fbcdn.net/rsrc.php/v4/yx/r/ Frame 0F91 0
0

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame 0D46 30 B
278 B 642ms
642ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=580ea9b4-5007-4e48-ab46-71eb064c6e17

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://cdn.holmesmind.com
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: nginx

GET
H/1.1 200
OK pixel
580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/ Frame 0D46 0
177 B 2348ms
657ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/pixel?bd=580ea9b4-5007-4e48-ab46-71eb064c6e17&t=cf&referrer=https%3A%2F%2Freurl.cc

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 05 Dec 2025 20:22:45 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
DATA 200
OK truncated
/ Frame 0F91 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0F91 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0F91 155 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7808605ddd1f0eaa454aa444293d2f0260943e51e53838fca46506e6a69fe521

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET cm
ad.holmesmind.com/adserver/ Frame 2103 0
0

GET
H3 200 result_MYSTIC_9ad9ac21-b578-42eb-860b-0e94c4d3ce46_0-390x220.jpeg
nearbymed.com/wp-content/uploads/2025/05/ 16 KB
17 KB 363ms
306ms Image
image/jpeg 172.67.222.174
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://nearbymed.com/wp-content/uploads/2025/05/result_MYSTIC_9ad9ac21-b578-42eb-860b-0e94c4d3ce46_0-390x220.jpeg
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.222.174 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 23ab0c2877a7f77afc338ebf80d2642ba151b95b00750fa8055efcd2353da3e8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cf-cache-status: HIT
etag: "68d811c8-4136"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=zb1G3GR216h4Gc0CNlIYryORiINrMdS3VIhAc0jIVrMr3gCBkMli9t9fYym%2Bfbxq4s7GyoyZGhv99KNGBNN5iklDNqw5If0Ibt3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: image/jpeg
last-modified: Sat, 27 Sep 2025 16:33:12 GMT
vary: accept-encoding
priority: u=1,i
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9a9641d6c8d6ef97-WAW
accept-ranges: bytes
content-length: 16694
server: cloudflare

GET
H2 200 Image_1_Leo_Wong_Art_Installation__Peony_Pond.jpg
mma.prnasia.com/media2/2839236/ 49 KB
50 KB 453ms
339ms Image
image/jpeg 104.18.95.225
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://mma.prnasia.com/media2/2839236/Image_1_Leo_Wong_Art_Installation__Peony_Pond.jpg?p=medium600
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.18.95.225 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: a4b33269e81d0a7556a7faaa0ee0fb1e97b8935345ed6b0241befcd95d879663

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cf-cache-status: BYPASS
access-control-allow-methods: GET, POST, OPTIONS
expires: Fri, 05 Dec 2025 20:22:44 GMT
server-timing: intid;desc=86e44bf4fa1566d2
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: image/jpeg
last-modified: Fri, 05 Dec 2025 20:22:43 GMT
vary: *, Accept-Encoding
access-control-allow-headers: Content-Type
cache-control: public, max-age=1
cf-ray: 9a9641d73e55ecb4-WAW
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50156
x-powered-by: ASP.NET
server: cloudflare

GET
H2 200 1764922819-4b9941f48d591b6ed55e155b1fd1efdd-840x525.jpg
img.gbyhn.com.tw/2025/12/ 61 KB
61 KB 173ms
43ms Image
image/jpeg 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://img.gbyhn.com.tw/2025/12/1764922819-4b9941f48d591b6ed55e155b1fd1efdd-840x525.jpg
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.96.3 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66ff4ad29ec9611c45b2a36c657f7637f3b993dd6a1b2c011d2f63059e1a1ed4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cf-cache-status: HIT
age: 43056
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=DIjS4ZcO8Lc2q5B4NyAOy0KYpcszGwcrNlEkJEwPXfkFVYR0T%2FfwP7taGPSWAAhxvSUhZ%2FpJ8f3lFGDBRhVWZLGHzVdO%2BZGgEttDTrNt%2BIw%3D"}]}
expires: Fri, 12 Dec 2025 08:25:06 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: image/jpeg
last-modified: Fri, 05 Dec 2025 08:20:19 GMT
vary: accept-encoding
cache-control: public, max-age=604800
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9a9641d74e410287-WAW
accept-ranges: bytes
content-length: 61986
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET
H2 200 2024-LINE-Go%E3%80%81Uber%E3%80%81%E5%8F%B0%E7%81%A3%E5%A4%A7%E8%BB%8A%E9%9A%8A%E9%AB%98%E5%9B%9E%E9%A5%8B%E4%BF%A1%E7%94%A8%E5%8D%A1%E6%8E%A8%E8%96%A6-1080x630.jpg
creditcards.com.tw/wp-content/uploads/2024/10/ 46 KB
47 KB 236ms
67ms Image
image/webp 192.0.78.24
AUTOMATTIC

General

Check archive.org

Download Go to Show image

Full URL

https://creditcards.com.tw/wp-content/uploads/2024/10/2024-LINE-Go%E3%80%81Uber%E3%80%81%E5%8F%B0%E7%81%A3%E5%A4%A7%E8%BB%8A%E9%9A%8A%E9%AB%98%E5%9B%9E%E9%A5%8B%E4%BF%A1%E7%94%A8%E5%8D%A1%E6%8E%A8%E8%96%A6-1080x630.jpg?crop=1

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.24 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

6167fd340131937aa85eb5de6051b6891a17b303ffca682704a89007eda6a97f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

etag: "bdc46d514a4e8b0b"
x-bytes-saved: 21327
x-content-type-options: nosniff
access-control-allow-methods: GET, HEAD
expires: Mon, 06 Dec 2027 00:00:33 GMT
server-timing: a8c-cdn, dc;desc=bur, cache;desc=HIT;dur=1.0, a8c-cdn, dc;desc=hhn, cache;desc=HIT;dur=2.0
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: image/webp
last-modified: Fri, 05 Dec 2025 12:00:33 GMT
vary: Accept
strict-transport-security: max-age=31536000
cache-control: public, max-age=63115200
timing-allow-origin: *
x-nc: HIT bur 7
access-control-allow-origin: *
content-length: 47102
x-ac: 18.hhn _atomic_ams HIT
server: nginx

GET
H2 200 renews-title1.png
re-news.tw/images/ 24 KB
24 KB 943ms
456ms Image
image/png 35.185.136.122
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://re-news.tw/images/renews-title1.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.185.136.122 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 122.136.185.35.bc.googleusercontent.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e9b96bc538ceb220fc5caff0d0a67916b74cf07b2bada0b3296a17b1b99c9990

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

accept-ranges: bytes
content-length: 24493
date: Fri, 05 Dec 2025 20:22:43 GMT
etag: "61a30347-5fad"
content-type: image/png
last-modified: Sun, 28 Nov 2021 04:19:19 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H2 200 2025112917574367.jpg
img.racingcharger.tw/wp-content/uploads/2025/11/ 741 KB
742 KB 607ms
475ms Image
image/jpeg 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://img.racingcharger.tw/wp-content/uploads/2025/11/2025112917574367.jpg
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.97.3 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55d72e6c27809e3d9fcee9bfacc5e736e6c8c0f032004a22ca1f1ff2f4594af3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: max-age=14400
cf-cache-status: HIT
speculation-rules: "/cdn-cgi/speculation"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=QvoSIBaJVlOMwmn6%2FysErtk0nNyUwAVt%2FXNZWaVkJaj%2B33xSyibmhrVksYUyaZs0fhr3T5SugUah6TLpBRC0Cm1Kw7VoPNQMGXywmohLYr%2FMhznY"}]}
cf-ray: 9a9641d7595fa58e-WAW
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 758789
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: image/jpeg
last-modified: Sat, 29 Nov 2025 17:57:33 GMT
server: cloudflare
vary: accept-encoding

GET
H2 200 file.png
static.wixstatic.com/media/9a254c_bd6ab9dc57c349009b5f1eedc6fb236d~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/ 1010 KB
1011 KB 236ms
80ms Image
image/png 65.8.131.77
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.wixstatic.com/media/9a254c_bd6ab9dc57c349009b5f1eedc6fb236d~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-77.fra60.r.cloudfront.net
Software: openresty/1.27.1.2 /
Resource Hash: 76e0fe9b59aa81409567a77b7f5cfaebcbe6d1a5586d4979c5a83a327f68d517

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-cf-id: 9eXrMsVQOz9ITiU07Ujm7UMcwVjGcqonHpCPMjdgRPqJGR6vFjRtfQ==
cache-control: public, max-age=2592000, immutable
timing-allow-origin: *
age: 2330165
via: 1.1 google, 1.1 581599a51772a76c2489c9d094b70226.cloudfront.net (CloudFront)
x-wixmp-trace: projects/wix-media-infrastructure/traces/35DDxtzFv1ht1XOKyqok8D3bN6S
access-control-allow-origin: *
x-seen-by: image-manipulator-698889fbf5-v58vj
content-length: 1033732
alt-svc: h3=":443"; ma=86400
date: Sat, 08 Nov 2025 21:06:38 GMT
content-type: image/png
x-cache: Hit from cloudfront
server: openresty/1.27.1.2
x-amz-cf-pop: FRA60-P13

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 2103 332 KB
0 0ms
0ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

eff958d6a66dede8a64c252dcf84e69d34c888460d5fcf6f835e655ab487d352

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-kRLP7T2G' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-kRLP7T2G' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=4967, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: n9NCX0Qo9s6D3uiA0rimFqs7y4e5TA96pubqlvSKiLyByoV1Ct0j74QY3edQ11ON2lJ+iCh+TsgHVn88NnVEog==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 88493
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 main.js Show response
cdn.holmesmind.com/module/product/inner/inner_image/ Frame BC71 26 KB
27 KB 754ms
754ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/module/product/inner/inner_image/main.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 651219c93cab2078fb7f9f5f3d091d56009b1108ff95b312d5b518a8639fbf2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: 5eDfF61po8mbPAqic7Z9nmad18STHB0v
etag: "9570d1addd7f3b91ecb1c725d51a1458"
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 26746
x-amz-cf-id: YPqnAm4eHBftb0WkC-svZszATJaHPD9ctwm-GRNSQCZ4RWlJCn0-Fw==
date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: application/javascript
last-modified: Wed, 21 Aug 2024 05:57:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 cf.png
cdn.holmesmind.com/ Frame BC71 2 KB
3 KB 79ms
79ms Image
image/png 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.holmesmind.com/cf.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bca7ee31fc622c935a1ba3d3d012111f3aab926dc898ed011513fc7a9145f90e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

vary: accept-encoding
x-amz-version-id: JXDsYp0MpCsC07xlgs6M6Edv23lP_HUM
etag: "7cb0cc414e01c6f48a9eefee02d81959"
age: 66443
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2399
x-amz-cf-id: Et6849nOA9ZdrAJp92xauzz8zb_REuEObgw1_v9c717FmzGJnv7wvw==
date: Fri, 05 Dec 2025 01:55:21 GMT
content-type: image/png
last-modified: Mon, 19 Jun 2023 03:09:39 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame D992 13 KB
0 0ms
0ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=22214&rf=https%3A%2F%2Freurl.cc%2F4bojVj%23Conditions&n=179&o=4&fc=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&d=1&b=2&ts=1&ii=3&FPCK=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV&fp_uuid=1145-bd1db5d407aafb5bfeea3645c2ba5d4d&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 21
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: sVl61sJ5OMdZbsXBirafzD8UINUHcFCAT_MbkxqqZM5wMq1ziAzWAA==
date: Fri, 05 Dec 2025 20:22:41 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 4701 105 KB
0 0ms
0ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

942be2506062746af49ca904cb7cfb0525cf8f0458f26b150beccfd5c76f1abf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 781 / 20427 / m202512020101 / config-hash: 5063855111797697403
x-content-type-options: nosniff
expires: Fri, 05 Dec 2025 20:22:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 05 Dec 2025 20:22:40 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34189
x-xss-protection: 0
server: cafe

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 1807 424 KB
143 KB 68ms
66ms Script
application/javascript 142.250.186.136
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

a3c0f52ebbfefe83fa961c630cedb37dab39544f9da04a9b323928bc6efa57bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 05 Dec 2025 20:22:43 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146680
date: Fri, 05 Dec 2025 20:22:43 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512020101/ Frame 4701 609 KB
0 4ms
4ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512020101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

cdf207042b9030c6e625d7042dac68355209cda211f30a59d25b2b4baafd8c1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 10021983320797522262
age: 11497
x-content-type-options: nosniff
expires: Sat, 05 Dec 2026 17:11:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 05 Dec 2025 17:11:03 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 197115
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202512040101/ Frame 4701 64 KB
0 1ms
1ms Other
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202512040101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

8d23693251d0923a21dba7083e1e3a58a18123b146cebbcefb828e1caa7c3aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 4740477158928784528
age: 15673
x-content-type-options: nosniff
expires: Fri, 12 Dec 2025 16:01:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 05 Dec 2025 16:01:27 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 22756
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202512040101"

GET cm
ad.holmesmind.com/adserver/ Frame 2345 0
0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame BBAB 332 KB
0 0ms
0ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

eff958d6a66dede8a64c252dcf84e69d34c888460d5fcf6f835e655ab487d352

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-kRLP7T2G' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 05 Dec 2025 20:22:42 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-kRLP7T2G' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=4967, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: n9NCX0Qo9s6D3uiA0rimFqs7y4e5TA96pubqlvSKiLyByoV1Ct0j74QY3edQ11ON2lJ+iCh+TsgHVn88NnVEog==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 88493
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 collect Show response
track.91app.io/ext/v1/ Frame 2EA6 46 B
66 B 306ms
305ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=pl-PL&ht=1764966163317&evtid=e0c3af79-f755-41b0-bbf6-2e02f80643a6&tid=5&cid=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&did=ef9e78ef-5482-47ab-8dd8-b185fabaceb6&fpids=[{%22version%22:%223.4.1%22,%22id%22:%22c2989916ac4d8bd626c538c8e43b0f75%22}]&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 2d01bab223123dda078936e64e792c2881faa503049973c1ccad05ba16a1738b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:43 GMT
x-cloud-trace-context: 5586531b2c9ceacdd90a3c7649f8f889
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame 2EA6 46 B
66 B 308ms
307ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 2d01bab223123dda078936e64e792c2881faa503049973c1ccad05ba16a1738b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 05 Dec 2025 20:22:43 GMT
x-cloud-trace-context: fa009fb118ae8929d90a3c7649f8f704
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

POST
H2 204 collect
region1.analytics.google.com/g/ Frame 1807 0
0 53ms
52ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-M4J67EDHV2&gtm=45je5c31v9235662620za200zd9235662620&_p=1764966163158&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tcfd=10001&cid=1361717008.1764966161&ul=pl-pl&sr=1600x1200&_ng=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=1&pscdl=noapi&_s=1&tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~105391253~115583767~115938466~115938468~116184927~116184929~116217636~116217638~116682876&sid=1764966163&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F4bojVj&dt=&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2887
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
stats.g.doubleclick.net/g/ Frame 1807 0
20 B 56ms
56ms Ping
text/plain 74.125.71.155
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ng=1&tid=G-M4J67EDHV2&cid=1361717008.1764966161&gtm=45je5c31v9235662620za200zd9235662620&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=1&tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~105391253~115583767~115938466~115938468~116184927~116184929~116217636~116217638~116682876
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.71.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wn-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.pl/ads/ Frame 1807 42 B
63 B 84ms
83ms Image
image/gif 172.217.18.3
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.pl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ng=1&tid=G-M4J67EDHV2&cid=1361717008.1764966161&gtm=45je5c31v9235662620za200zd9235662620&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=1&tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~105391253~115583767~115938466~115938468~116184927~116184929~116217636~116217638~116682876&z=549170216

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 05 Dec 2025 20:22:43 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 collect
region1.analytics.google.com/g/ Frame 1807 0
0 80ms
80ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-M4J67EDHV2&gtm=45je5c31v9235662620za200zd9235662620&_p=1764966163158&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tcfd=10001&cid=1361717008.1764966161&ul=pl-pl&sr=1600x1200&_ng=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=1&pscdl=noapi&_eu=AEAAAAQ&_s=2&tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~105391253~115583767~115938466~115938468~116184927~116184929~116217636~116217638~116682876&sid=1764966163&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F4bojVj&dt=&en=scroll&epn.percent_scrolled=90&tfd=2892
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.pl/ads/ Frame 1807 42 B
63 B 82ms
82ms Image
image/gif 172.217.18.3
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 05 Dec 2025 20:22:43 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 close_btn.png
cdn.holmesmind.com/image/creative/20200629/ 23 KB
23 KB 55ms
55ms Image
image/png 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.holmesmind.com/image/creative/20200629/close_btn.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0e83a8ffdd161a80e179732ca1f514ee08dcc3c4a128baa9c92bcffebc2a7c52

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

vary: accept-encoding
x-amz-version-id: eftIHNkZLvs_zrsThuw3iZTYVcb2Z_86
etag: "e08deb6b87983b314d88a24c09f4d13f"
age: 55916
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 23254
x-amz-cf-id: qPDWydZmjdPiKZlLFtk4pYoK4c5JfNbggNtYDtyisRbiAf-2tbrsng==
date: Fri, 05 Dec 2025 04:55:37 GMT
content-type: image/png
last-modified: Thu, 15 Jun 2023 01:01:51 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame DD2F 36 B
400 B 654ms
651ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

5549efe01874036e137b091ee2b4892e7ad074c84fef987cadf7457f321fa423

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 1807 36 B
400 B 1329ms
674ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

5549efe01874036e137b091ee2b4892e7ad074c84fef987cadf7457f321fa423

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 9D5D 36 B
400 B 1950ms
621ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

5549efe01874036e137b091ee2b4892e7ad074c84fef987cadf7457f321fa423

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:45 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame D992 36 B
400 B 2602ms
650ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

5549efe01874036e137b091ee2b4892e7ad074c84fef987cadf7457f321fa423

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:45 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 182E 36 B
400 B 3280ms
677ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

5549efe01874036e137b091ee2b4892e7ad074c84fef987cadf7457f321fa423

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:46 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET /
t.ssp.hinet.net/ Frame BC71 0
0

GET /
t.ssp.hinet.net/ Frame 94FF 0
0

GET /
t.ssp.hinet.net/ Frame BD96 0
0

GET cm
ad.holmesmind.com/adserver/ Frame 2EA6 0
0

GET
H2 200 i
ad.holmesmind.com/adserver/ Frame BC71 0
64 B 277ms
277ms Image
image/png 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ad.holmesmind.com/adserver/i?ut=1764966162&p=14210:131880:236322:f144226e6da892c1211a9d9585901d51:14756
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

date: Fri, 05 Dec 2025 20:22:43 GMT
content-type: image/png
server: nginx

GET
H2 200 5cf10104f128d8b4524b2f34f4e23082.jpg
cdn.holmesmind.com/image/14756/ Frame BC71 49 KB
49 KB 55ms
54ms Image
image/jpeg 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.holmesmind.com/image/14756/5cf10104f128d8b4524b2f34f4e23082.jpg
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 834b68c690ad07a8043013788c16c639128d421a11df1b3732956360c81463a8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

vary: accept-encoding
x-amz-version-id: wrbWxuSFb_RR5JAbnYA.vTVJ4FB5f189
etag: "553b2a6b6a5ae232dd73e2833e61f6bb"
age: 38556
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 49962
x-amz-cf-id: 0Al5odg-u7naVgkcB-_TSfIz7fz3espa3SfrnY4iPFQogZRs8CVsdQ==
date: Fri, 05 Dec 2025 09:44:08 GMT
content-type: image/jpeg
last-modified: Thu, 11 Jul 2024 03:03:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 cf.png
cdn.holmesmind.com/ Frame BC71 2 KB
0 0ms
0ms Image
image/png 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.holmesmind.com/cf.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bca7ee31fc622c935a1ba3d3d012111f3aab926dc898ed011513fc7a9145f90e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

vary: accept-encoding
x-amz-version-id: JXDsYp0MpCsC07xlgs6M6Edv23lP_HUM
etag: "7cb0cc414e01c6f48a9eefee02d81959"
age: 66443
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2399
x-amz-cf-id: Et6849nOA9ZdrAJp92xauzz8zb_REuEObgw1_v9c717FmzGJnv7wvw==
date: Fri, 05 Dec 2025 01:55:21 GMT
content-type: image/png
last-modified: Mon, 19 Jun 2023 03:09:39 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ Frame 94C9 0
0 80ms
78ms Fetch
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512020101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

GET
H2 200 main.js Show response
cdn.holmesmind.com/module/product/bottom/bottom_movingBoardImage/ Frame D992 30 KB
31 KB 761ms
759ms Script
application/javascript 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/module/product/bottom/bottom_movingBoardImage/main.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3c0642a0b40f3a3af331b2656807af9976a2c253f1832a1cc425b5a34b749126

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: oPURJqW0INbA0k3Quit7sv8wfaDNa84y
etag: "7a49664bf2d2a38d88923d4339c70d25"
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 31097
x-amz-cf-id: 9vYG468jZCm9hvCXiqfBtclch9N10utxh8g5v7og0EAvIwuFqjr2xw==
date: Fri, 05 Dec 2025 20:22:45 GMT
content-type: application/javascript
last-modified: Wed, 21 Aug 2024 05:57:29 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
H2 200 cf.png
cdn.holmesmind.com/ Frame D992 2 KB
0 0ms
0ms Image
image/png 65.8.131.4
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.holmesmind.com/cf.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.131.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-131-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bca7ee31fc622c935a1ba3d3d012111f3aab926dc898ed011513fc7a9145f90e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

vary: accept-encoding
x-amz-version-id: JXDsYp0MpCsC07xlgs6M6Edv23lP_HUM
etag: "7cb0cc414e01c6f48a9eefee02d81959"
age: 66443
via: 1.1 387be0cf162c8cb6592090f9496a1e92.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2399
x-amz-cf-id: Et6849nOA9ZdrAJp92xauzz8zb_REuEObgw1_v9c717FmzGJnv7wvw==
date: Fri, 05 Dec 2025 01:55:21 GMT
content-type: image/png
last-modified: Mon, 19 Jun 2023 03:09:39 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P13
x-amz-server-side-encryption: AES256

GET
DATA 200
OK truncated
/ Frame BC71 351 B
0 Image
image/svg+xml

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f31502bd8b58a334acc32b695f096fde6dd136fa1106f2d2d9fb4825d41b1abb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame DD2F 0
187 B 476ms
476ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 1807 0
187 B 1125ms
649ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 9D5D 0
187 B 1777ms
652ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:45 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame D992 0
187 B 2427ms
650ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:46 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 182E 0
187 B 3076ms
649ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:46 GMT
content-type: image/png
vary: Origin
server: nginx

GET cm
t.ssp.hinet.net/ Frame BC71 0
0

GET cm
t.ssp.hinet.net/ Frame 94FF 0
0

GET cm
t.ssp.hinet.net/ Frame BD96 0
0

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame DD2F 30 B
271 B 675ms
674ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=580ea9b4-5007-4e48-ab46-71eb064c6e17

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: nginx

GET
H/1.1 200
OK pixel
580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/ Frame DD2F 0
177 B 2028ms
662ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/pixel?bd=580ea9b4-5007-4e48-ab46-71eb064c6e17&t=50ef57&referrer=

Requested by

Host: reurl.cc
URL: https://reurl.cc/4bojVj

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 05 Dec 2025 20:22:45 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 av Show response
ad.holmesmind.com/adserver/ Frame BC71 0
139 B 278ms
278ms Script
text/html 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/av?p=14210:131880:236322:f144226e6da892c1211a9d9585901d51:14756&type=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/drawV2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ Frame 4701 0
0 79ms
78ms Fetch
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512020101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

GET
H2 200 i
ad.holmesmind.com/adserver/ Frame D992 0
64 B 276ms
276ms Image
image/png 35.74.59.205
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ad.holmesmind.com/adserver/i?ut=1764966162&p=22214:244470:299470:363574fbd98e128a35ecca9697b4bd47:39361
Requested by: Host: reurl.cc
URL: https://reurl.cc/4bojVj
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.59.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-74-59-205.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

date: Fri, 05 Dec 2025 20:22:44 GMT
content-type: image/png
server: nginx

GET
H/1.1 200
OK pixel
580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/ Frame 1807 0
177 B 2267ms
346ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/pixel?bd=580ea9b4-5007-4e48-ab46-71eb064c6e17&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 05 Dec 2025 20:22:46 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H/1.1 200
OK favicon.ico
reurl.cc/ 1 KB
1 KB 459ms
459ms Other
image/x-icon 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 1346d656b8aeb6a9d4d5bd59ab8026645fcc90874f54814d6ee8cac226d32a51

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/4bojVj

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-47e"
Connection: keep-alive
Expires: Fri, 12 Dec 2025 20:22:45 GMT
Accept-Ranges: bytes
Content-Length: 1150
Date: Fri, 05 Dec 2025 20:22:45 GMT
Content-Type: image/x-icon
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET pixel
580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/ Frame 9D5D 0
0

POST
H3 204 collect
region1.analytics.google.com/g/ 0
0 51ms
50ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-S9B9ZLEX4D&gtm=45je5c31v9235665865za200zd9235665865&_p=1764966160210&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&cid=1361717008.1764966161&ul=pl-pl&sr=1600x1200&_ng=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391253~115497441~115583767~115616985~115938466~115938469~116184927~116184929~116217636~116217638~116474638&sid=1764966160&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F4bojVj&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=scroll&epn.percent_scrolled=90&_et=4&tfd=7456
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:45 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
region1.analytics.google.com/g/ 0
0 50ms
50ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-N394QBRGC0&gtm=45je5c31v897965293za200zb9235665865zd9235665865&_p=1764966160210&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&cid=1361717008.1764966161&ul=pl-pl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391252~115583767~115938466~115938469~116184927~116184929~116217636~116217638~116474638&sid=1764966160&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F4bojVj&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=scroll&epn.percent_scrolled=90&_et=4&tfd=7520
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:45 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
region1.analytics.google.com/g/ 0
0 50ms
50ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-ZDFZCDVDK1&gtm=45je5c40h2v9181474282za200zb9235665865zd9235665865&_p=1764966160210&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&cid=1361717008.1764966161&ecid=985653488&ul=pl-pl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391253~115583767~115938466~115938468~116184927~116184929~116217636~116217638~116474638&sid=1764966160&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F4bojVj&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=scroll&epn.percent_scrolled=90&_et=5&tfd=7546
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 05 Dec 2025 20:22:45 GMT
content-type: text/plain
server: Golfe2

GET pixel
580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/ Frame D992 0
0

GET pixel
580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/ Frame 182E 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: connect.facebook.net
URL: https://connect.facebook.net//log/error?p=pixel&sl=2&v=2.9.244&e=Bot%20detection%20rules%20loaded%20from%20server%20config%20-%20pixel_id%3A%201675200226052423&ue=0&rs=stable&rqm=FGET

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/cm?app=91app&P=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uid=ba1d7185-fd4b-4360-b116-31f3e7142d0a

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/cm?app=91app&P=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uid=c46791c7-23a1-436f-b722-3e2e25388ad1

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/cm?app=91app&P=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uid=53b1b38b-7415-4db4-977b-7b0a525a86cd

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v5/yd/l/0,cross/Ubb04fKqLUX.css

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yi/r/oArmeD_dMWe.js

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/y2/r/IBMxsyOas0F.js

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yd/r/atv-3qMDl2i.js

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4izx64/y9/l/pl_PL-j/jTXziHT_cAS.js

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yx/r/v_kkAv_-wGQ.js

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/cm?app=91app&P=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uid=9d28de6f-f851-4f3f-8c22-abccd31b9ed0

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/cm?app=91app&P=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uid=ef9e78ef-5482-47ab-8dd8-b185fabaceb6

Domain: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/

Domain: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/

Domain: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/cm?app=91app&P=828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ&uid=ef9e78ef-5482-47ab-8dd8-b185fabaceb6

Domain: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/cm?c=50ef57&cid=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV

Domain: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/cm?c=50ef57&cid=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV

Domain: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/cm?c=50ef57&cid=1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV

Domain: 580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net
URL: https://580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/pixel?bd=580ea9b4-5007-4e48-ab46-71eb064c6e17&t=50ef57&referrer=

Domain: 580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net
URL: https://580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/pixel?bd=580ea9b4-5007-4e48-ab46-71eb064c6e17&t=50ef57&referrer=

Domain: 580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net
URL: https://580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net/pixel?bd=580ea9b4-5007-4e48-ab46-71eb064c6e17&t=50ef57&referrer=

Verdicts & Comments Add Verdict or Comment

79 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

35 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
web.alipearlhair.com/	1970-01-21 10:16:13	Name: XSRF-TOKEN Value: eyJpdiI6InAxTzR3ajg1TDhJaGFHek03ZnBcL2VBPT0iLCJ2YWx1ZSI6Ijl6czBjZHEzcGtrdEtoNFB1UmtOeTIyMzF3b1VtRTdKY3Vmbm9BSGltVFFQbGlISENQeDBrcHZPeEkzS2pUYzZkbE5jVWlPRkpjNzRsdk9UcmhDZStnPT0iLCJtYWMiOiJmOGZjMTQxOWU5NDcxODc3Y2ZmMjY3NmU5MzI2ZTFmOWNmYjQxNmRmMDg1ZmZiMzQxZWM5NmY4ZTljMWJjZTJiIn0%3D
web.alipearlhair.com/	1970-01-21 10:16:13	Name: laravel_session Value: eyJpdiI6ImpaOXJuaFwvXC9EV0lEVGNoVEpOZWNMdz09IiwidmFsdWUiOiJQeDk1RTl6S3grVjVTQWtyV3N1NnJIbjVOOTlnaHV4TGttanZ3T09zYzNweFZockVaR3hKeGwzVmJzcGV0UEV6MFwvd1wvUmxkM2NJaktNUGJieHJHelZRPT0iLCJtYWMiOiI1NTVmMmIzZjQyMzdiMjQxZmQ3NTcyNjg3MjE2NzllMjE1ZDBiZTlmM2Q2MDgyYTk3M2RkZmJlNDhhMTgxYzUwIn0%3D
.reurl.cc/	1970-01-21 19:52:06	Name: _ga_S9B9ZLEX4D Value: GS2.1.s1764966160$o1$g0$t1764966160$j60$l0$h0
.reurl.cc/	1970-01-21 19:52:06	Name: _ga_N394QBRGC0 Value: GS2.1.s1764966160$o1$g0$t1764966160$j60$l0$h0
.reurl.cc/	1970-01-21 19:52:06	Name: _ga_ZDFZCDVDK1 Value: GS2.1.s1764966160$o1$g0$t1764966160$j60$l0$h985653488
.reurl.cc/	1970-01-21 10:59:18	Name: ISMD5VERSION Value: 1
.reurl.cc/	1970-01-21 19:37:42	Name: FCCDCF Value: %5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%22f8ab929f-4055-4bbf-a3a0-f780b3051ff6%5C%22%2C%5B1764966160%2C922000000%5D%5D%22%5D%5D%5D
.holmesmind.com/	1970-01-21 10:37:13	Name: Vision Value: 20251206-23:59,20251206-07,20251206-07,20251206-23:59
.holmesmind.com/	1970-01-21 10:37:13	Name: C Value: null
.holmesmind.com/	1970-01-21 12:41:03	Name: RK Value: null
.holmesmind.com/	1970-01-21 19:52:06	Name: P Value: 828963-Su7eSybIS8lOeC8kHt1he8gwpbkJqtHJ
.reurl.cc/	1970-01-21 10:17:32	Name: _gid Value: GA1.2.1977214255.1764966161
.reurl.cc/	1970-01-21 10:16:06	Name: _gat Value: 1
.reurl.cc/	1970-01-21 12:25:42	Name: _fbp Value: fb.1.1764966161420.701414630182911357
.holmesmind.com/	1970-01-21 10:17:03	Name: test_cookie Value: CheckForPermission
.reurl.cc/	1970-01-21 10:59:18	Name: CFFPCKUUID Value: 2609-b3rVWDbbd3wcbEbmTZ7VbjghIn4J79ax
.reurl.cc/	1970-01-21 10:59:18	Name: CFFPCKUUIDMAIN Value: 1145-gLs7U7o0PrzPdKKJDPPSYZ78sbCGBLJV
.reurl.cc/	1970-01-21 10:59:18	Name: FPUUID Value: 1145-bd1db5d407aafb5bfeea3645c2ba5d4d
.holmesmind.com/	1970-01-21 10:17:32	Name: fcm Value: 1
onead.onevision.com.tw/	1970-01-21 19:01:42	Name: onevision_guid Value: 26d460bc-d218-11f0-ab46-42010a00008f
onead.onevision.com.tw/	1970-01-21 19:01:42	Name: oid Value: 26d460a6-d218-11f0-ab46-42010a00008f
reurl.cc/	1970-01-21 19:01:42	Name: oid Value: %257B%2522oid%2522%253A%252226d460bc-d218-11f0-ab46-42010a00008f%2522%252C%2522ts%2522%253A-62135596800%252C%2522v%2522%253A%252220201117%2522%257D
.eyeota.net/	1970-01-21 10:16:06	Name: SERVERID Value: 23062~DM
.hinet.net/	1970-01-21 19:52:06	Name: uuid Value: 580ea9b4-5007-4e48-ab46-71eb064c6e17
.lndata.com/	1970-01-21 19:02:10	Name: admckid Value: 2512060422421853222
.holmesmind.com/	1970-01-21 10:37:13	Name: R Value: null
.holmesmind.com/	1970-01-21 12:41:03	Name: G Value: we3u7ZGJymKY5J47cKd8kQ==
track.91app.io/	1970-01-21 19:52:06	Name: deviceid Value: ef9e78ef-5482-47ab-8dd8-b185fabaceb6
.reurl.cc/	1970-01-21 19:52:06	Name: _ga Value: GA1.1.1361717008.1764966161
.prnasia.com/	1970-01-21 10:16:07	Name: __cf_bm Value: rRs2bna8SoogYBgEfxeoGdUGBlR5Z._.LhYJVxkn1j0-1764966163-1.0.1.1-pvqd.1g9yhDWAtMvBFcT520yXiYOlFhB0hOG5LcqjDBtrMZ8jZzQAWqAIUEZgejZ7yUHS1GoMiurnZu7DKVtNA5HeSwNXRvi_W4o1muzlAs
.reurl.cc/	1970-01-21 19:52:06	Name: _ga_M4J67EDHV2 Value: GS2.1.s1764966163$o1$g0$t1764966163$j60$l0$h0
.reurl.cc/	1970-01-21 10:17:32	Name: _ht_50ef57 Value: 1
.c.appier.net/	1970-01-21 19:01:42	Name: _auid Value: xFLGMdUJDqW3WyBrEz8zaQ
.reurl.cc/	1970-01-21 19:01:42	Name: __htid Value: 580ea9b4-5007-4e48-ab46-71eb064c6e17
.reurl.cc/	1970-01-21 10:16:09	Name: _ht_em Value: 1

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://cdn.holmesmind.com/js/capmapping.htm Message: [GroupMarkerNotSet(crbug.com/242999)!:A0F030036C300000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://cdn.holmesmind.com/js/capmapping.htm Message: [GroupMarkerNotSet(crbug.com/242999)!:A06034176C300000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://cdn.holmesmind.com/js/capmapping.htm Message: [GroupMarkerNotSet(crbug.com/242999)!:A0A01A0C6C300000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://cdn.holmesmind.com/js/capmapping.htm Message: [GroupMarkerNotSet(crbug.com/242999)!:A090FB0C6C300000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://reurl.cc/4bojVj#Conditions(Line 206) Message: [GroupMarkerNotSet(crbug.com/242999)!:A0902D036C300000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.
network	error	URL: chrome-error://chromewebdata/ Message: Failed to load resource: the server responded with a status of 400 ()
other	error	URL: chrome-error://chromewebdata/ Message: Refused to display 'https://www.facebook.com/' in a frame because it set 'X-Frame-Options' to 'deny'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net
ad-specs.guoshipartners.com
ad.holmesmind.com
ad2.apx.appier.net
anymind360.com
bcp.crwdcntrl.net
c.holmesmind.com
cdn.holmesmind.com
cdn.jsdelivr.net
cm-dev-poc.holmesmind.com
cm.g.doubleclick.net
cm.lndata.com
connect.facebook.net
creditcards.com.tw
fcm.holmesmind.com
fcm2.holmesmind.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
gocm.c.appier.net
img.gbyhn.com.tw
img.racingcharger.tw
m.holmesmind.com
match.adsrvr.org
mma.prnasia.com
nearbymed.com
onead.onevision.com.tw
pagead2.googlesyndication.com
prebid-asia.creativecdn.com
prebid.scupio.com
ps.eyeota.net
re-news.tw
region1.analytics.google.com
reurl.cc
scontent.xx.fbcdn.net
securepubads.g.doubleclick.net
static.criteo.net
static.wixstatic.com
static.xx.fbcdn.net
stats.g.doubleclick.net
t.ssp.hinet.net
track.91app.io
tracking-client.91app.com
trc.taboola.com
web.alipearlhair.com
www.facebook.com
www.google-analytics.com
www.google.pl
www.googletagmanager.com
580ea9b4-5007-4e48-ab46-71eb064c6e17.t.ssp.hinet.net
ad.holmesmind.com
connect.facebook.net
static.xx.fbcdn.net
t.ssp.hinet.net
103.132.192.30
104.18.95.225
107.178.241.176
116.50.36.71
142.250.184.226
142.250.184.238
142.250.185.106
142.250.185.142
142.250.185.162
142.250.185.226
142.250.186.136
15.197.193.217
151.101.129.229
151.101.129.44
151.101.65.55
157.240.253.1
157.240.253.35
170.106.34.222
172.104.70.67
172.217.18.3
172.67.222.174
178.250.1.39
18.178.75.163
18.184.216.10
18.66.122.42
188.114.96.3
188.114.97.3
192.0.78.24
203.74.221.3
203.75.214.136
210.59.219.34
216.239.34.36
216.58.206.35
34.95.67.231
35.185.136.122
35.190.36.98
35.201.76.198
35.201.76.93
35.227.249.156
35.229.143.32
35.74.59.205
35.75.149.212
52.213.88.74
65.8.131.4
65.8.131.77
74.125.71.155
04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0e83a8ffdd161a80e179732ca1f514ee08dcc3c4a128baa9c92bcffebc2a7c52
0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2
0f390ce52e359572f07f6a2fb047858bdbdea327f0049589d71f6f31fd48d7f7
100d72a28123bcee974e8642b8bf1c0865bf1034c9b59f59597d53809e192fdc
1346d656b8aeb6a9d4d5bd59ab8026645fcc90874f54814d6ee8cac226d32a51
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1e80a28383bfc03e89db5bac76e1ae460940a8349dd10009e43a71884f26647d
1fb03c2367e0610493a5a3e5234f92905c53ec3d8c9b858b3a9bcfe0d64da7bb
2324d5a73d13df21e0676fb0d47c8068386736a614dfb6230a0f4713b90397bc
23ab0c2877a7f77afc338ebf80d2642ba151b95b00750fa8055efcd2353da3e8
24973a749cdbc649e2a96f6eac9ff3ed1ad2f3bc5e9ce8d3cb07d3d0a33293d8
25355805f44af99037c6b951f9afd762f5fd74eb126aba4b2f82cafa563c0f90
2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840
2d01bab223123dda078936e64e792c2881faa503049973c1ccad05ba16a1738b
2f46f1b48f154c914566b81946177099d828e99bec918e3e0516326434b630b3
31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30
351966dece7214af3b43d9a94f07c1c936176ad5dd81f0bbe1f6b319b4cd96d1
352d0915216b13b935f1abedea04d4a039802faaf69153ae71c377410990e322
35c0e60050b3d63cdb7514054aeef91b80f43862efa367e36c9423e827ada5c6
35d3296d29f50d6719933c6e20d0830ef359a297952723fa080ccfda9fcdf912
365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60
36ce58e725022c68db17f7afb3adfa7bc354822d0146e37c25be5680ec876cdf
3774a7ce325859b32b6b0b01bde2879c75b81131fafe4a584b18b744711bd75d
37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d
3c0642a0b40f3a3af331b2656807af9976a2c253f1832a1cc425b5a34b749126
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3cb25639a350059fadd9a51748f340a0eda4200318f77c30a4d24e98e0224fb1
4160fa3d770eaab9357e77de1ceb06e03b04d4392adc870d2485110517b3747e
45444d590a67d30e8b2fde01bb6482f829383b64bf14a4b19b86e22fdc319fbb
45b9d5d6bd09c3cb5bc66e810f5705296bd6c0131608772a1a9e59d34e3ccce1
4da2dc78cc23591a9ee3285ba8f3891fa57b506b7902fbdd35fa5a2172566c55
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
5549efe01874036e137b091ee2b4892e7ad074c84fef987cadf7457f321fa423
55d72e6c27809e3d9fcee9bfacc5e736e6c8c0f032004a22ca1f1ff2f4594af3
57d8d192e38209cc36c358984a2edd8682971c9437188459d4a7bd22b1f1813e
57e3fef09cab4680c25c4a06c9c1ce195325f5d502d4d75b5d53a7c2f14e2916
5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd
60280ebcf60053f7d378a772ecfabb60b0b69b9634e19105cb2307b126918447
6092c7e0cb5d5573df0d0c7e4612a54cfe97569131f48425f820214493e6ac70
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
6167fd340131937aa85eb5de6051b6891a17b303ffca682704a89007eda6a97f
620a382665ff035abb643a19e12f088aef2bc27b55398d4ae3f131b773be6355
6215cea030001547475bd19ec624e50c85af367309e115d7813ae4eaff664d32
651219c93cab2078fb7f9f5f3d091d56009b1108ff95b312d5b518a8639fbf2a
66ff4ad29ec9611c45b2a36c657f7637f3b993dd6a1b2c011d2f63059e1a1ed4
68feb2e00f000a42974febaa88dd61de1e5f876912eff189479c9c26d1ca8b90
6d4c444108925dc2ec8fe761f55a6760241c123740591e1348f0f94a653a3985
6e9ab8ab1d57a0695a66577e348ae4343e1a92f70cb4835a52c4863f11114037
6f02119b53d02d3c5d1785f81818a184f07ae539610c5c3e7a45250b49bbcd65
732e208e90e13189d119365b871cb4ea641565626b991a7813976dff09bcb5c2
73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c
76e0fe9b59aa81409567a77b7f5cfaebcbe6d1a5586d4979c5a83a327f68d517
7808605ddd1f0eaa454aa444293d2f0260943e51e53838fca46506e6a69fe521
81f5894460e95b43b98c07da054ab3c7a9e0a63c2c49f27c28d4a4ec4096c149
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
834b68c690ad07a8043013788c16c639128d421a11df1b3732956360c81463a8
85d975fe1653f5887624fe0f43e807d29a8bab129f0ca6c85cc1a8fd65f5e537
873b90cdbff7dcb26e9ea34c647a5d15e83daecca768a816619dd38a503c09b5
8d23693251d0923a21dba7083e1e3a58a18123b146cebbcefb828e1caa7c3aa3
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e
8f7636a0b0dd99d49730dd0dd8f91db5bc76ead8b17b834c2071fdeac92ce0f4
942be2506062746af49ca904cb7cfb0525cf8f0458f26b150beccfd5c76f1abf
96e3e8dfde6b1042514824bac1b44282d4a76bac028f2d767f6534dce2cf3db0
979da208bbb4e7e775544f9ea351afe3cae32b74ca9b980e05762c5b0533fe17
9aa92a9a076fd2e55f339cd82c8b540e96ea0a4e4c7c12da6602edfadf2a0819
9c0a49abd67df4146a5f64eccddbdc7c1e0a2b3d7e535611ec4f7167dd4462ed
a04a65eacad9ae6127a33e15a1d4308b270c88b706604c36be0febbed864f32d
a2380272606f9124d05c4c5dbcd85a8988af81cd8c6197c5e5a57f27cd164f70
a3c0f52ebbfefe83fa961c630cedb37dab39544f9da04a9b323928bc6efa57bb
a4b33269e81d0a7556a7faaa0ee0fb1e97b8935345ed6b0241befcd95d879663
a7c26694861bbd926c7d903f707b406aa8eaa6a5065a3acb6c8e0028e8eaee6e
a809a621787685f33490a4f83b2d55092728abc4a3ea4feb8aec82619613d081
a9e73e3bb6ae4b6ce48801d8c36b1fb23aabd6a0c84b1c2fec44a7d8119f9baa
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab187b70940d331c60646d5731fa8e86d6958ba69dfa241361e39d30d81c2d31
aca35582942ff81da0f14188ec61af389d37ebe2a7c29c6145e53a9f885bec55
adfa45260a1306cb5fefc1f17c1b5e7b61135534a82bf1b8e3d0540af7e07e3b
ae34e3ebad4a87ef0e35c5a6b9ce15c05836f35ca05ef59d7fb1c59b181907b7
b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5
bca7ee31fc622c935a1ba3d3d012111f3aab926dc898ed011513fc7a9145f90e
c03e2d819d8b3afb3db6440a0b76e8c5428e59b9e7de6740554a225e1ba87f0e
c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821
c2bfe20d9d58935828e75bc753e2655f240621077408ae64f9b40a20f5125487
ca0aeb2fa960412185179c8973a01406d9fa3d180da741b13df4b4f5406f11fe
ca393d099e0df45caede45790fc97408a6d427576be3b80bedfccf9a1a71bd32
cda69bc838ea763c9bdd1a55d3d400cf3135c70bff641395f707f48364d7e1e4
cdf207042b9030c6e625d7042dac68355209cda211f30a59d25b2b4baafd8c1d
cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda
d50cad871cd252aca6f998215c8f1c3d372bef86a324e45fc1f60d0b5e1e61b5
d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795
d867626032b0bd239f90051d884f30405a037456f9d81d8ffb20781dc98b5fde
ddc8b32cf4e328a8b39ea4149387ade5384e622d658fc780042c3a755a00e0d0
de2f37247915d4d168ac703231fe1bf5d5d1ec670928b3e86c409870ecc35167
df654baaa62745cddc3a03e7c835de7a31eae3c3e75b9ed4cfcfa446c994b064
e08b04a6939040e0bf913ed4bf2c7c78e0dbeed2f1f559155638f5d26d487f64
e1c1642a7b402e888a16272cd16de45afc68b34c918aed03cbcbce55d74f21a2
e325b081132e5ef6099df35494e9abcf692301f37359daeaedb7849435fc23c2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2
e9b96bc538ceb220fc5caff0d0a67916b74cf07b2bada0b3296a17b1b99c9990
eaa389a2363ce41b4ddfe710ee8fafbe17cac66f85450ccfbc40ab90e66d7dc7
eba9a487e95bf24fc365b6581165276a5989b9a98df6a50ed0e56bccc2822f8a
eedbdad9864da701eda6a0b8472480cfc4050659a674e0336142cf075d198ccb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
eff958d6a66dede8a64c252dcf84e69d34c888460d5fcf6f835e655ab487d352
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
f1d5f46a83573232e102e008949b96e936bcb4b95b9a0992e095b568b8951683
f21233ebfc628748be56e544ee831e6723e5534227b3d48b06b77a7bda1f6e28
f31502bd8b58a334acc32b695f096fde6dd136fa1106f2d2d9fb4825d41b1abb
f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b
f425cd304d655b9c5d610769ceb94f478a3f6e5c0987a47271ee0299c0a42b22
f7d2701889f81b41c32ea429a484f62fbe8f04db715f32dac597f6aba3a9331d
f8bcd058a4fbee6f8b68a5ff2930470c1890fc714914c226cf950b4e11ffdcdb
f984e83b815eba00d303bff671d57c7d2b183b6372a88bdd7c80ed8f57108dc5
fe1bcebb6fc407517010ed86454b1845d11f42d29b921dc365058d52a498fa3d

reurl.cc Open in urlscan Pro 35.229.143.32 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

280 Requests

86 %HTTPS

0 %IPv6

37 Domains

49 Subdomains

42 IPs

8 Countries

4679 kBTransfer

13344 kBSize

35 Cookies

21 Outgoing links

Page URL History

Redirected requests

280 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

reurl.cc Open in urlscan Pro
35.229.143.32 Public Scan

Screenshot
Live screenshot

Full Image

280
Requests

86 %
HTTPS

0 %
IPv6

37
Domains

49
Subdomains

42
IPs

8
Countries

4679 kB
Transfer

13344 kB
Size

35
Cookies

280 HTTP transactions
5 data transactions