Submitted URL:
http://tr.mafiacasino.com/pub/go/rMSJn/-cD4R 4mo old
Effective URL:
https://mafiacasino.com/ca/login 5yr old
Submission: On July 22 via api (July 22nd 2026, 2:13:11 am UTC) from NZ — Scanned from CA

Summary

This website contacted 75 IPs in 9 countries across 84 domains to perform 439 HTTP transactions. The main IP is 185.207.196.198, located in Marshall Islands and belongs to nalmi-as NALMI LIMITED, MH. The main domain is mafiacasino.com. 5yr old
TLS certificate: Issued by WE1 on May 26th 2026. Valid for: 3mo.
This is the only time mafiacasino.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 185.207.196.82 185.207.196.82 213846 (nalmi-as ...) (nalmi-as NALMI LIMITED)
1 1 185.207.199.145 185.207.199.145 213846 (nalmi-as ...) (nalmi-as NALMI LIMITED)
1 128 185.207.196.198 185.207.196.198 213846 (nalmi-as ...) (nalmi-as NALMI LIMITED)
11 172.253.115.94 172.253.115.94 15169 (GOOGLE) (GOOGLE - Google LLC)
2 172.67.148.159 172.67.148.159 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 54.75.32.104 54.75.32.104 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 34.252.32.161 34.252.32.161 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 142.251.163.97 142.251.163.97 15169 (GOOGLE) (GOOGLE - Google LLC)
1 188.166.63.236 188.166.63.236 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
1 2 104.18.95.41 104.18.95.41 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 18.160.41.58 18.160.41.58 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 74.119.117.6 74.119.117.6 19750 (AS-CRITEO) (AS-CRITEO - Criteo Corp.)
3 23.48.203.44 23.48.203.44 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1 18.239.6.77 18.239.6.77 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 185.167.164.45 185.167.164.45 198622 (ADFORM Ad...) (ADFORM Adform A/S)
1 37.157.2.230 37.157.2.230 198622 (ADFORM Ad...) (ADFORM Adform A/S)
2 104.21.19.114 104.21.19.114 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 198.54.115.232 198.54.115.232 22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap)
3 13.225.196.71 13.225.196.71 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2 44.208.106.13 44.208.106.13 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2 57.144.70.128 57.144.70.128 32934 (FACEBOOK) (FACEBOOK - Facebook)
1 2 199.38.167.130 199.38.167.130 54312 (ROCKETFUEL) (ROCKETFUEL - Rocket Fuel Inc.)
1 13.225.196.122 13.225.196.122 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
12 14 74.119.117.62 74.119.117.62 19750 (AS-CRITEO) (AS-CRITEO - Criteo Corp.)
4 172.253.63.101 172.253.63.101 15169 (GOOGLE) (GOOGLE - Google LLC)
1 2 185.167.164.53 185.167.164.53 198622 (ADFORM Ad...) (ADFORM Adform A/S)
2 63.33.10.76 63.33.10.76 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 3.167.88.60 3.167.88.60 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3 3 172.253.139.156 172.253.139.156 15169 (GOOGLE) (GOOGLE - Google LLC)
1 3 199.38.167.131 199.38.167.131 54312 (ROCKETFUEL) (ROCKETFUEL - Rocket Fuel Inc.)
2 4 68.67.161.208 68.67.161.208 29990 (ASN-APPNEXUS) (ASN-APPNEXUS - Xandr Inc.)
2 3 100.61.34.68 100.61.34.68 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
9 207.65.32.88 207.65.32.88 62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
2 35.244.159.8 35.244.159.8 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
2 4 100.59.229.44 100.59.229.44 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 23.221.252.28 23.221.252.28 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1 51.222.241.145 51.222.241.145 16276 (OVH OVH SAS) (OVH OVH SAS)
1 3 104.18.27.193 104.18.27.193 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 100.60.188.223 100.60.188.223 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
9 16 35.211.202.130 35.211.202.130 43515 (YOUTUBE G...) (YOUTUBE Google Ireland Limited)
1 2 151.101.194.49 151.101.194.49 54113 (FASTLY) (FASTLY - Fastly)
1 3 35.211.155.243 35.211.155.243 43515 (YOUTUBE G...) (YOUTUBE Google Ireland Limited)
13 74.119.117.57 74.119.117.57 19750 (AS-CRITEO) (AS-CRITEO - Criteo Corp.)
1 7 185.167.164.38 185.167.164.38 198622 (ADFORM Ad...) (ADFORM Adform A/S)
1 185.167.164.48 185.167.164.48 198622 (ADFORM Ad...) (ADFORM Adform A/S)
8 8 172.253.139.157 172.253.139.157 15169 (GOOGLE) (GOOGLE - Google LLC)
12 15 68.67.181.102 68.67.181.102 29990 (ASN-APPNEXUS) (ASN-APPNEXUS - Xandr Inc.)
49 55 67.202.16.78 67.202.16.78 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
7 13 98.85.140.86 98.85.140.86 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
11 11 52.223.40.198 52.223.40.198 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6 6 3.233.2.188 3.233.2.188 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
12 12 44.219.75.51 44.219.75.51 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
6 6 207.65.37.181 207.65.37.181 62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
6 6 74.121.140.211 74.121.140.211 30419 (PAEDAE-INC) (PAEDAE-INC - PaeDae)
6 6 100.61.75.197 100.61.75.197 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
6 8.28.7.84 8.28.7.84 62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
6 35.227.244.76 35.227.244.76 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
7 104.18.26.193 104.18.26.193 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 9 3.217.204.162 3.217.204.162 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
7 7 3.80.18.4 3.80.18.4 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
3 3 3.167.88.21 3.167.88.21 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3 4 35.244.154.8 35.244.154.8 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
6 100.25.13.4 100.25.13.4 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
6 150.171.28.10 150.171.28.10 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
6 23.23.167.209 23.23.167.209 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
6 70.42.32.63 70.42.32.63 22075 (AS-OUTBRAIN) (AS-OUTBRAIN - Outbrain)
7 216.19.192.2 216.19.192.2 26667 (RUBICONPR...) (RUBICONPROJECT - Magnite)
6 216.22.16.9 216.22.16.9 30633 (LEASEWEB-...) (LEASEWEB-USA-WDC - Leaseweb USA)
6 141.226.227.75 141.226.227.75 200478 (TABOOLA-A...) (TABOOLA-AS Taboola.com ltd)
6 151.101.194.132 151.101.194.132 54113 (FASTLY) (FASTLY - Fastly)
6 34.237.134.39 34.237.134.39 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
6 23.12.145.162 23.12.145.162 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2 8 54.237.4.69 54.237.4.69 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
8 14 69.194.240.13 69.194.240.13 26120 (RHYTHMONE) (RHYTHMONE - RhythmOne)
1 100.60.151.254 100.60.151.254 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
4 54.172.43.65 54.172.43.65 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1 3.225.158.18 3.225.158.18 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 2 34.111.113.62 34.111.113.62 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 2 172.64.146.215 172.64.146.215 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 57.144.70.1 57.144.70.1 32934 (FACEBOOK) (FACEBOOK - Facebook)
1 2 54.243.157.64 54.243.157.64 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 63.181.140.45 63.181.140.45 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 35.214.197.234 35.214.197.234 15169 (GOOGLE) (GOOGLE - Google LLC)
2 3 44.208.117.202 44.208.117.202 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 107.178.254.65 107.178.254.65 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 18.239.6.48 18.239.6.48 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3 18.239.6.20 18.239.6.20 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
439 75
Apex Domain
Subdomains
Transfer
129 mafiacasino.com 2 redirects
tr.mafiacasino.com 4mo old
mafiacasino.com 5yr old
3 MB
55 mediawallahscript.com 49 redirects
partner.mediawallahscript.com — Cisco Umbrella Rank: 5184 9yr old
47 KB
28 criteo.com 12 redirects
dynamic.criteo.com — Cisco Umbrella Rank: 2313 8yr old
gum.criteo.com — Cisco Umbrella Rank: 545 10yr old
sslwidget.criteo.com — Cisco Umbrella Rank: 1922 13yr old
dis.criteo.com — Cisco Umbrella Rank: 759 13yr old
52 KB
21 pubmatic.com 6 redirects
image2.pubmatic.com — Cisco Umbrella Rank: 1117 10yr old
image6.pubmatic.com — Cisco Umbrella Rank: 948 10yr old
simage4.pubmatic.com — Cisco Umbrella Rank: 1387 9yr old
simage2.pubmatic.com — Cisco Umbrella Rank: 1013 10yr old
4 KB
19 adnxs.com 14 redirects
ib.adnxs.com — Cisco Umbrella Rank: 312 10yr old
secure.adnxs.com — Cisco Umbrella Rank: 728 10yr old
18 KB
16 bidswitch.net 9 redirects
x.bidswitch.net — Cisco Umbrella Rank: 543 13yr old
3 KB
13 crwdcntrl.net 7 redirects
sync.crwdcntrl.net — Cisco Umbrella Rank: 943 8yr old
4 KB
12 lijit.com 12 redirects
ap.lijit.com — Cisco Umbrella Rank: 935 10yr old
3 KB
11 360yield.com 3 redirects
ad.360yield.com — Cisco Umbrella Rank: 886 13yr old
8 KB
11 adsrvr.org 11 redirects
match.adsrvr.org — Cisco Umbrella Rank: 439 10yr old
7 KB
11 doubleclick.net 11 redirects
cm.g.doubleclick.net — Cisco Umbrella Rank: 308 10yr old
234 B
11 adform.net 2 redirects
s2.adform.net — Cisco Umbrella Rank: 5851 13yr old
track.adform.net — Cisco Umbrella Rank: 4418 13yr old
a1.adform.net — Cisco Umbrella Rank: 28797 13yr old
c1.adform.net — Cisco Umbrella Rank: 846 13yr old
39 KB
11 gstatic.com
fonts.gstatic.com — Cisco Umbrella Rank: 47 10yr old
254 KB
10 casalemedia.com 1 redirects
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 815 12yr old
r.casalemedia.com — Cisco Umbrella Rank: 2628 13yr old
dsum.casalemedia.com — Cisco Umbrella Rank: 1858 10yr old
7 KB
8 1rx.io 8 redirects
sync.1rx.io — Cisco Umbrella Rank: 676 10yr old
2 KB
8 3lift.com 2 redirects
eb2.3lift.com — Cisco Umbrella Rank: 574 10yr old
2 KB
8 liadm.com 7 redirects
i.liadm.com — Cisco Umbrella Rank: 845 9yr old
i6.liadm.com — Cisco Umbrella Rank: 2903 6yr old
5 KB
8 bidr.io 7 redirects
segment.prod.bidr.io — Cisco Umbrella Rank: 6789 9yr old
match.prod.bidr.io — Cisco Umbrella Rank: 828 9yr old
4 KB
7 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 539 10yr old
token.rubiconproject.com — Cisco Umbrella Rank: 727 10yr old
10 KB
7 tremorhub.com
partners.tremorhub.com — Cisco Umbrella Rank: 1716 10yr old
criteo-partners.tremorhub.com — Cisco Umbrella Rank: 3411 8yr old
2 KB
7 media.net
contextual.media.net — Cisco Umbrella Rank: 1533 10yr old
cs.media.net — Cisco Umbrella Rank: 793 8yr old
3 KB
7 demdex.net 2 redirects
dpm.demdex.net — Cisco Umbrella Rank: 343 10yr old
5 KB
6 unrulymedia.com
sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1496 6yr old
2 KB
6 clmbtech.com
ade.clmbtech.com — Cisco Umbrella Rank: 3015 11yr old
1 KB
6 teads.tv
criteo-sync.teads.tv — Cisco Umbrella Rank: 2675 8yr old
sync.teads.tv Failed 10yr old
847 B
6 taboola.com
sync-t1.taboola.com — Cisco Umbrella Rank: 2010 6yr old
2 KB
6 smartadserver.com
rtb-csync.smartadserver.com — Cisco Umbrella Rank: 822 10yr old
2 KB
6 outbrain.com
sync.outbrain.com — Cisco Umbrella Rank: 1277 9yr old
2 KB
6 postrelease.com
jadserve.postrelease.com — Cisco Umbrella Rank: 973 10yr old
2 KB
6 bing.com
c.bing.com — Cisco Umbrella Rank: 194 13yr old
2 KB
6 mediavine.com
exchange.mediavine.com — Cisco Umbrella Rank: 2336 7yr old
3 KB
6 mathtag.com 6 redirects
sync.mathtag.com — Cisco Umbrella Rank: 1248 10yr old
5 KB
6 imrworldwide.com 6 redirects
obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com — Cisco Umbrella Rank: 10505 5yr old
2 KB
5 rfihub.com 2 redirects
20874641p.rfihub.com 10mo old
a.rfihub.com — Cisco Umbrella Rank: 2902 10yr old
p.rfihub.com — Cisco Umbrella Rank: 1078 10yr old
9 KB
5 iconvert.network
cdn.iconvert.network — Cisco Umbrella Rank: 225794 7yr old
event.iconvert.network — Cisco Umbrella Rank: 356155 7yr old
42 KB
4 agkn.com
aa.agkn.com Failed — Cisco Umbrella Rank: 741 10yr old
2 KB
4 rlcdn.com
idsync.rlcdn.com Failed — Cisco Umbrella Rank: 737 10yr old
2 KB
4 eyeota.net 2 redirects
ps.eyeota.net — Cisco Umbrella Rank: 1287 13yr old
2 KB
4 rezync.com 3 redirects
live.rezync.com — Cisco Umbrella Rank: 2011 9yr old
4 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 99 13yr old
728 B
4 seondnsresolve.com
409423117828234e774a05c21da2005b.seondnsresolve.com 25d old
eb6a7d55b667d9b6e52e2ebe363274d7b395eb78.seondnsresolve.com — Cisco Umbrella Rank: 49982 3yr old
0425ce576b70653b18f084f63cc38c29.seondnsresolve.com 25d old
2 KB
3 exelator.com 2 redirects
loadm.exelator.com — Cisco Umbrella Rank: 2928 13yr old
load77.exelator.com — Cisco Umbrella Rank: 6740 9yr old
2 KB
3 sportradarserving.com 1 redirects
a.sportradarserving.com — Cisco Umbrella Rank: 3258 7yr old
use.sportradarserving.com — Cisco Umbrella Rank: 21842 6yr old
3 KB
3 sportradar.com
tm.ads.sportradar.com — Cisco Umbrella Rank: 21080 7yr old
tracker.ads.sportradar.com — Cisco Umbrella Rank: 22155 7yr old
64 KB
2 linkedin.com 1 redirects
px.ads.linkedin.com — Cisco Umbrella Rank: 322 9yr old
1 KB
2 tapad.com 1 redirects
pixel.tapad.com — Cisco Umbrella Rank: 704 10yr old
1 KB
2 everesttech.net 1 redirects
sync-tm.everesttech.net — Cisco Umbrella Rank: 951 9yr old
650 B
2 openx.net
us-u.openx.net — Cisco Umbrella Rank: 696 10yr old
eu-u.openx.net — Cisco Umbrella Rank: 1809 10yr old
355 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 226 13yr old
105 KB
2 safe-track.pro
safe-track.pro 3mo old
1 KB
2 rubiconredirect.com
scripts.rubiconredirect.com — Cisco Umbrella Rank: 324249 7yr old
rtg.rubiconredirect.com — Cisco Umbrella Rank: 471312 4yr old
2 KB
2 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 1075 10yr old
script.hotjar.com — Cisco Umbrella Rank: 1430 10yr old
63 KB
2 cloudflare.com 1 redirects
challenges.cloudflare.com — Cisco Umbrella Rank: 1091 5yr old
24 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 63 13yr old
297 KB
2 seondf.com
cdn.seondf.com — Cisco Umbrella Rank: 68240 5yr old
118 KB
1 pippio.com
pippio.com — Cisco Umbrella Rank: 1267 12yr old
551 B
1 loopme.me
csync.loopme.me — Cisco Umbrella Rank: 982 9yr old
168 B
1 adscale.de
ih.adscale.de — Cisco Umbrella Rank: 2864 10yr old
59 B
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 122 11yr old
19 B
1 stackadapt.com 1 redirects
sync.srv.stackadapt.com — Cisco Umbrella Rank: 755 11yr old
1 KB
1 seadform.net
a1.seadform.net — Cisco Umbrella Rank: 34961 8yr old
667 B
1 rqtrk.eu
wt.rqtrk.eu — Cisco Umbrella Rank: 1543 6yr old
350 B
1 rfihub.net
c1.rfihub.net — Cisco Umbrella Rank: 5449 10yr old
7 KB
1 cookie-script.com
cdn.cookie-script.com — Cisco Umbrella Rank: 17313 6yr old
221 KB
1 oafiaca5inuo.com 1 redirects
oafiaca5inuo.com 9mo old
377 B
0 onetag-sys.com Failed
onetag-sys.com Failed 11yr old
0 onaudience.com Failed
pixel.onaudience.com Failed 9yr old
0 mediarithmics.com Failed
cookie-matching.mediarithmics.com Failed 9yr old
0 rtactivate.com Failed
bpi.rtactivate.com Failed 7yr old
0 contentexchange.me Failed
match.contentexchange.me Failed 7yr old
0 smaato.net Failed
s.ad.smaato.net Failed 6yr old
0 weborama.fr Failed
redirect.frontend.weborama.fr Failed 9yr old
0 id5-sync.com Failed
id5-sync.com Failed 9yr old
0 w55c.net Failed
pm.w55c.net Failed 11yr old
0 adition.com Failed
dsp.adfarm1.adition.com Failed 10yr old
0 audrte.com Failed
a.audrte.com Failed 9yr old
0 userreport.com Failed
pdw-adf.userreport.com Failed 8yr old
0 semasio.net Failed
uipglob.semasio.net Failed 9yr old
0 fwmrm.net Failed
user-sync.fwmrm.net Failed 1yr old
0 yieldlab.net Failed
ad.yieldlab.net Failed 10yr old
0 zemanta.com Failed
b1sync.zemanta.com Failed 10yr old
0 revcontent.com Failed
trends.revcontent.com Failed 10yr old
0 thrtle.com Failed
thrtle.com Failed 8yr old
0 getblue.io Failed
event.getblue.io Failed 9yr old
439 84
Domain Requested by
128 mafiacasino.com 1 redirects mafiacasino.com
55 partner.mediawallahscript.com 49 redirects
16 x.bidswitch.net 9 redirects
14 gum.criteo.com 12 redirects dynamic.criteo.com
gum.criteo.com
13 sync.crwdcntrl.net 7 redirects c1.adform.net
12 ap.lijit.com 12 redirects
12 dis.criteo.com
11 ad.360yield.com 3 redirects c1.adform.net
11 match.adsrvr.org 11 redirects c1.adform.net
11 ib.adnxs.com 7 redirects
11 cm.g.doubleclick.net 11 redirects
11 fonts.gstatic.com mafiacasino.com
8 sync.1rx.io 8 redirects
8 eb2.3lift.com 2 redirects c1.adform.net
8 simage2.pubmatic.com c1.adform.net
8 secure.adnxs.com 7 redirects c1.adform.net
7 i.liadm.com 7 redirects
7 c1.adform.net 1 redirects a1.adform.net
c1.adform.net
7 dpm.demdex.net 2 redirects
6 sync.targeting.unrulymedia.com
6 ade.clmbtech.com
6 criteo-partners.tremorhub.com
6 criteo-sync.teads.tv
6 sync-t1.taboola.com
6 rtb-csync.smartadserver.com c1.adform.net
6 pixel.rubiconproject.com
6 sync.outbrain.com
6 jadserve.postrelease.com
6 c.bing.com
6 exchange.mediavine.com
6 r.casalemedia.com
6 cs.media.net
6 simage4.pubmatic.com
6 match.prod.bidr.io 6 redirects
6 sync.mathtag.com 6 redirects
6 image6.pubmatic.com 6 redirects
6 obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com 6 redirects
4 aa.agkn.com c1.adform.net
4 idsync.rlcdn.com
4 ps.eyeota.net 2 redirects c1.adform.net
4 live.rezync.com 3 redirects
4 www.google-analytics.com mafiacasino.com
3 dsum-sec.casalemedia.com 1 redirects c1.adform.net
3 cdn.iconvert.network www.googletagmanager.com
mafiacasino.com
cdn.iconvert.network
2 loadm.exelator.com 2 redirects
2 px.ads.linkedin.com 1 redirects
2 pixel.tapad.com 1 redirects
2 a.sportradarserving.com 1 redirects
2 tracker.ads.sportradar.com tm.ads.sportradar.com
tracker.ads.sportradar.com
2 sync-tm.everesttech.net 1 redirects
2 p.rfihub.com 2 redirects
2 a.rfihub.com c1.rfihub.net
2 event.iconvert.network
2 a1.adform.net 1 redirects
2 connect.facebook.net safe-track.pro
connect.facebook.net
2 segment.prod.bidr.io 1 redirects
2 safe-track.pro www.googletagmanager.com
safe-track.pro
2 challenges.cloudflare.com 1 redirects
2 www.googletagmanager.com mafiacasino.com
www.googletagmanager.com
2 eb6a7d55b667d9b6e52e2ebe363274d7b395eb78.seondnsresolve.com mafiacasino.com
2 cdn.seondf.com mafiacasino.com
1 use.sportradarserving.com
1 dsum.casalemedia.com
1 eu-u.openx.net c1.adform.net
1 pippio.com c1.adform.net
1 load77.exelator.com c1.adform.net
1 csync.loopme.me c1.adform.net
1 ih.adscale.de c1.adform.net
1 token.rubiconproject.com c1.adform.net
1 www.facebook.com
1 sync.srv.stackadapt.com 1 redirects
1 i6.liadm.com
1 a1.seadform.net
1 sslwidget.criteo.com dynamic.criteo.com
1 partners.tremorhub.com
1 wt.rqtrk.eu
1 contextual.media.net
1 us-u.openx.net
1 image2.pubmatic.com
1 script.hotjar.com static.hotjar.com
1 20874641p.rfihub.com c1.rfihub.net
1 rtg.rubiconredirect.com
1 scripts.rubiconredirect.com mafiacasino.com
1 track.adform.net www.googletagmanager.com
1 s2.adform.net mafiacasino.com
1 c1.rfihub.net mafiacasino.com
1 tm.ads.sportradar.com mafiacasino.com
1 dynamic.criteo.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 cdn.cookie-script.com mafiacasino.com
1 0425ce576b70653b18f084f63cc38c29.seondnsresolve.com mafiacasino.com
1 409423117828234e774a05c21da2005b.seondnsresolve.com mafiacasino.com
1 oafiaca5inuo.com 1 redirects
1 tr.mafiacasino.com 1 redirects
0 onetag-sys.com Failed c1.adform.net
0 pixel.onaudience.com Failed c1.adform.net
0 cookie-matching.mediarithmics.com Failed c1.adform.net
0 bpi.rtactivate.com Failed c1.adform.net
0 match.contentexchange.me Failed c1.adform.net
0 s.ad.smaato.net Failed c1.adform.net
0 sync.teads.tv Failed c1.adform.net
0 redirect.frontend.weborama.fr Failed c1.adform.net
0 id5-sync.com Failed c1.adform.net
0 pm.w55c.net Failed c1.adform.net
0 dsp.adfarm1.adition.com Failed c1.adform.net
0 a.audrte.com Failed c1.adform.net
0 pdw-adf.userreport.com Failed c1.adform.net
0 uipglob.semasio.net Failed c1.adform.net
0 user-sync.fwmrm.net Failed c1.adform.net
0 ad.yieldlab.net Failed c1.adform.net
0 b1sync.zemanta.com Failed
0 trends.revcontent.com Failed
0 thrtle.com Failed
0 event.getblue.io Failed www.googletagmanager.com
439 114

This site contains no links.

Subject Issuer Validity Valid
mafiacasino.com
WE1
2026-05-26 -
2026-08-24
3mo crt.sh
*.gstatic.com
WR2
2026-06-29 -
2026-09-21
3mo crt.sh
seondf.com
WE1
2026-07-08 -
2026-10-06
3mo crt.sh
*.seondnsresolve.com
Amazon RSA 2048 M04
2026-05-20 -
2026-12-03
7mo crt.sh
eb6a7d55b667d9b6e52e2ebe363274d7b395eb78.seondnsresolve.com
Thawte TLS RSA CA G1
2026-03-20 -
2026-10-04
7mo crt.sh
*.google-analytics.com
WR2
2026-06-29 -
2026-09-21
3mo crt.sh
*.cookie-script.com
Sectigo Public Server Authentication CA DV R36
2025-08-07 -
2026-09-07
1yr crt.sh
*.hotjar.com
Amazon RSA 2048 M04
2026-03-24 -
2026-10-07
7mo crt.sh
*.criteo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-06-04 -
2026-09-02
3mo crt.sh
tracker.ads.sportradar.com
YR1
2026-06-10 -
2026-09-08
3mo crt.sh
*.rfihub.net
Amazon RSA 2048 M04
2025-08-31 -
2026-09-29
1yr crt.sh
track.adform.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2025-09-05 -
2026-10-06
1yr crt.sh
rubiconredirect.com
WE1
2026-06-22 -
2026-09-20
3mo crt.sh
safe-track.pro
Sectigo Public Server Authentication CA DV R36
2026-05-26 -
2026-12-10
7mo crt.sh
cdn.iconvert.network
Amazon RSA 2048 M01
2025-09-29 -
2026-10-27
1yr crt.sh
*.facebook.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-04-30 -
2026-07-29
3mo crt.sh
*.rfihub.com
Sectigo Public Server Authentication CA DV R36
2026-04-13 -
2026-10-28
7mo crt.sh
event.iconvert.network
Amazon RSA 2048 M01
2025-10-05 -
2026-11-02
1yr crt.sh
*.rezync.com
Amazon RSA 2048 M04
2026-07-21 -
2027-02-03
7mo crt.sh
*.pubmatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-02-18 -
2027-03-19
1yr crt.sh
*.openx.net
RapidSSL TLS RSA CA G1
2025-08-12 -
2026-08-19
1yr crt.sh
*.media.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2025-08-24 -
2026-08-25
1yr crt.sh
*.rqtrk.eu
RapidSSL TLS RSA CA G1
2026-05-11 -
2026-11-25
7mo crt.sh
*.tremorhub.com
Amazon RSA 2048 M01
2025-11-25 -
2026-12-24
1yr crt.sh
*.seadform.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2025-10-27 -
2026-11-12
1yr crt.sh
casalemedia.com
E8
2026-05-26 -
2026-08-24
3mo crt.sh
exchange.mediavine.com
Amazon RSA 2048 M04
2026-02-02 -
2027-03-03
1yr crt.sh
www.bing.com
Microsoft TLS G2 RSA CA OCSP 02
2026-05-03 -
2026-10-30
6mo crt.sh
*.postrelease.com
Amazon RSA 2048 M03
2025-08-25 -
2026-09-21
1yr crt.sh
*.outbrain.com
Thawte TLS RSA CA G1
2025-11-23 -
2026-12-02
1yr crt.sh
*.rubiconproject.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-03-16 -
2026-09-30
7mo crt.sh
*.smartadserver.com
DigiCert Global G3 TLS ECC SHA384 2020 CA1
2026-02-04 -
2027-02-10
1yr crt.sh
*.taboola.com
DigiCert Global G3 TLS ECC SHA384 2020 CA1
2025-12-17 -
2027-01-05
1yr crt.sh
*.teads.tv
Thawte TLS RSA CA G1
2026-03-29 -
2026-10-13
7mo crt.sh
colombiaonline.com
YR2
2026-07-09 -
2026-10-07
3mo crt.sh
*.bidswitch.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-07-08 -
2026-10-10
3mo crt.sh
*.360yield.com
Amazon RSA 2048 M01
2026-04-15 -
2026-10-29
7mo crt.sh
*.3lift.com
Amazon RSA 2048 M04
2026-01-11 -
2027-02-08
1yr crt.sh
*.adscale.de
Amazon RSA 2048 M04
2026-04-19 -
2026-11-02
7mo crt.sh
*.agkn.com
RapidSSL TLS RSA CA G1
2025-09-18 -
2026-09-17
1yr crt.sh
*.adnxs.com
GeoTrust TLS ECC CA G1
2025-09-25 -
2026-10-26
1yr crt.sh

This page contains 13 frames:

Primary Page: https://mafiacasino.com/ca/login
Frame ID: 264C462497C36EAFE856F0BBEB5244DE
Requests: 224 HTTP requests in this frame

Frame: https://mafiacasino.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/3104729c556c/main.js
Frame ID: 2E6A49FCB9F2B99BA1FD13562F8A9BAF
Requests: 2 HTTP requests in this frame

Frame: https://mafiacasino.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Frame ID: 2FC4EBBC752BF80309E754B3D42318FE
Requests: 2 HTTP requests in this frame

Frame: https://20874641p.rfihub.com/ca.html?ver=9&rb=55629&ca=20874641&_o=55629&_t=20874641&gpp=%7Bgpp_string_469%7D&gpp_sid=%7BgppSid%7D&gdpr=%7BgdprFlag%7D&gdpr_consent=%7BgdprConsent%7D&pe=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&pf=https%3A%2F%2Fmafiacasino.com%2Flogin&ra=37450207585374007
Frame ID: 3139D9E858DD1475B60F7083FD318813
Requests: 17 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?topUrl=mafiacasino.com&origin=onetag
Frame ID: C27015EBDC6DD76CACED6DDC24D211E3
Requests: 2 HTTP requests in this frame

Frame: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Frame ID: 7ECDA91EF402C82CEB32F7988BA7D6A5
Requests: 39 HTTP requests in this frame

Frame: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Frame ID: 4B692FEE79ED1DB42D79045C103C2F5F
Requests: 27 HTTP requests in this frame

Frame: https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Frame ID: 8C6DD5D2168A4DACDF1B33C4D6005EC8
Requests: 27 HTTP requests in this frame

Frame: https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Frame ID: 431EE3C62EB73B3CBF4E47896A9E4D27
Requests: 27 HTTP requests in this frame

Frame: https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Frame ID: F3307A1A24216EC16847E04859DE4149
Requests: 24 HTTP requests in this frame

Frame: https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Frame ID: 1C5E2DBBF76E0D5E43F87E8992BD0BF3
Requests: 24 HTTP requests in this frame

Frame: https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Frame ID: F31B1B334C4F5B345A9B00EE8C7A0647
Requests: 24 HTTP requests in this frame

Frame: https://a.rfihub.com/pstats.html?rb=55629&ca=20874641&ri=4e2b43a0b05601a54cd5d68955cc1c8a&stats=undefined&ra=2138447728798505
Frame ID: 80B225657662C105210C27D0CFE1F1AF
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

MafiaCasino Online Casino & Online Betting Sportsbook

Page URL History Show full URLs

  1. http://tr.mafiacasino.com/pub/go/rMSJn/-cD4R HTTP 307
    https://tr.mafiacasino.com/pub/go/rMSJn/-cD4R HTTP 302
    https://oafiaca5inuo.com/login HTTP 307
    https://mafiacasino.com/login Page URL
  2. https://mafiacasino.com/ca/login Page URL

Detected technologies

(JavaScript graphics)
Overall confidence: 100%
Detected patterns
  • (?:((?:\d+\.)+\d+)\/(?:dc\/)?)?dc(?:\.leaflet)?\.js

(Analytics)
Overall confidence: 50%
Detected patterns

(Advertising)
Overall confidence: 100%
Detected patterns
  • \.adform\.net/

(Segmentation)
Overall confidence: 100%
Detected patterns

(Advertising)
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

(Advertising)
Overall confidence: 100%
Detected patterns
  • segment\.prod\.bidr\.io

(Security)
Overall confidence: 100%
Detected patterns

(Cookie compliance)
(Security)
Overall confidence: 100%
Detected patterns

(Analytics)
Overall confidence: 100%
Detected patterns
  • connect\.facebook\.\w+/.+/fbevents\.js
  • connect\.facebook.\w+/signals/config/\d+\?v=([\d\.]+)

(Analytics)
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

(Tag managers)
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • \.googletagmanager\.com/

(Analytics)
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

(Email)
Overall confidence: 100%
Detected patterns
  • \.liadm\.com

(Advertising)
Overall confidence: 100%
Detected patterns
  • \.media\.net/

(Advertising)
Overall confidence: 100%
Detected patterns
  • \.mediavine\.com/

(Advertising)
Overall confidence: 100%
Detected patterns
  • \.postrelease\.com/

(Advertising)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

(Widgets)
Overall confidence: 100%
Detected patterns
  • \.outbrain\.com/

(Advertising)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com

(Advertising)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

(Advertising)
Overall confidence: 100%
Detected patterns
  • \.taboola\.com

(Advertising)
Overall confidence: 100%
Detected patterns
  • teads\.tv

Page Statistics

439
Requests

67 %
HTTPS

0 %
IPv6

84
Domains

114
Subdomains

75
IPs

9
Countries

4644 kB
Transfer

17589 kB
Size

122
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://tr.mafiacasino.com/pub/go/rMSJn/-cD4R HTTP 307
    https://tr.mafiacasino.com/pub/go/rMSJn/-cD4R HTTP 302
    https://oafiaca5inuo.com/login HTTP 307
    https://mafiacasino.com/login Page URL
  2. https://mafiacasino.com/ca/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://tr.mafiacasino.com/pub/go/rMSJn/-cD4R HTTP 307
  • https://tr.mafiacasino.com/pub/go/rMSJn/-cD4R HTTP 302
  • https://oafiaca5inuo.com/login HTTP 307
  • https://mafiacasino.com/login
Request Chain 14
  • https://mafiacasino.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://mafiacasino.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/3104729c556c/main.js
Request Chain 108
  • https://challenges.cloudflare.com/turnstile/v0/api.js HTTP 302
  • https://challenges.cloudflare.com/turnstile/v0/b/3104729c556c/api.js
Request Chain 131
  • https://segment.prod.bidr.io/associate-segment?buzz_key=dsp&segment_key=dsp-37338&value= HTTP 303
  • https://segment.prod.bidr.io/associate-segment?buzz_key=dsp&segment_key=dsp-37338&value=&_bee_ppp=1
Request Chain 205
  • https://a1.adform.net/Serving/TrackPoint/?pm=3960913&ADFPageName=mafiacasino.com%2Fca&ADFdivider=%7C&ord=82298351306&ADFtpmode=2&itm=eyJpdG1zIjpbeyJwaWQiOiJjYSJ9XX0&loc=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&CPref=https%3A%2F%2Fmafiacasino.com%2Flogin&Set1=en-CA%7Cen-CA%7C1600x1200%7C24 HTTP 302
  • https://a1.adform.net/Serving/TrackPoint/?CC=1&pm=3960913&ADFPageName=mafiacasino.com%2Fca&ADFdivider=%7C&ord=82298351306&ADFtpmode=2&itm=eyJpdG1zIjpbeyJwaWQiOiJjYSJ9XX0&loc=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&CPref=https%3A%2F%2Fmafiacasino.com%2Flogin&Set1=en-CA%7Cen-CA%7C1600x1200%7C24
Request Chain 210
  • https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=OTcwMDMzMjA0NDAyNjI0OTgy&forward= HTTP 302
  • https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=OTcwMDMzMjA0NDAyNjI0OTgy&forward=&google_tc= HTTP 302
  • https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEC1Z9wTcWMVCffj0sfy8XhU&google_cver=1
Request Chain 211
  • https://ib.adnxs.com/setuid?entity=18&code=970033204402624982&gdpr=&gdpr_consent=%7BgdprConsent%7D&redir= HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D970033204402624982%26gdpr%3D%26gdpr_consent%3D%257BgdprConsent%257D%26redir%3D
Request Chain 212
  • https://dpm.demdex.net/ibs:dpid=1121&dpuuid=970033204402624982&redir= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=970033204402624982&redir=
Request Chain 215
  • https://p.rfihub.com/cm?pub=24472&in=1&gdpr=&gdpr_consent=%7BgdprConsent%7D HTTP 302
  • https://ps.eyeota.net/match?uid=970033204402624982&bid=omt9pi0 HTTP 302
  • https://ps.eyeota.net/match/bounce/?uid=970033204402624982&bid=omt9pi0
Request Chain 218
  • https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=970033204402624982 HTTP 303
  • https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=970033204402624982&_li_chk=true&previous_uuid=f539a137813042408ed05ffc143770ff HTTP 303
  • https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=f539a137-8130-4240-8ed0-5ffc143770ff&us_privacy=1YN-
Request Chain 219
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=970033204402624982&forward= HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=970033204402624982&forward=&C=1
Request Chain 223
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=970033204402624982&expires=30&gdpr=&gdpr_consent=%7BgdprConsent%7D&gdpr_pd={GDPR_PD} HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=970033204402624982&expires=30&gdpr=&gdpr_consent=%7BgdprConsent%7D&gdpr_pd={GDPR_PD}
Request Chain 224
  • https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=amAnPgAAAJihpwBD
Request Chain 226
  • https://a.sportradarserving.com/pixel?type=js&aid=3212&id=1002438 HTTP 302
  • https://a.sportradarserving.com/ul_cb/pixel?type=js&aid=3212&id=1002438
Request Chain 233
  • https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30 HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Request Chain 234
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzbWVkSnl3Zw HTTP 302
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Request Chain 235
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 302
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Request Chain 236
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=fc1d52c8-50a3-4c1e-bcca-d724516e5637 HTTP 302
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=fc1d52c8-50a3-4c1e-bcca-d724516e5637&final=true&reqid=e97fd170-8572-11f1-97ce-21abbc9853d5&timestamp=2026-07-22T02%3A13%3A21.543Z HTTP 302
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync HTTP 302
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile_id%7D%26tag_format%3Dimg%26tag_action%3Dsync%26cb%3D%24%7Brandom%7D HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=453968853 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=vxsrv3i&ttd_tpi=1 HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=10ca1bb6-95f7-4722-a1e9-cf79bafb892e&tag_format=img&tag_action=sync&cb= HTTP 302
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb5c80b0-8572-11f1-a3f7-0bef8b7b55cd HTTP 302
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 307
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_retry=true HTTP 307
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=89086a60-2746-4100-8399-970d0fadd8ef&tag_format=img&tag_action=sync HTTP 302
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1 HTTP 303
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=33
Request Chain 239
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=5vwwNV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBYzZrTFB2aTgwRnBQJTJGZHk4akpZTnY&gdpr=0&gdpr_consent=&lac=y HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=5vwwNV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBYzZrTFB2aTgwRnBQJTJGZHk4akpZTnY&gdpr=0&gdpr_consent=&lac=y&ct=y
Request Chain 241
  • https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-zd0svUeroCOCSUKVjb8zA1-5feYaKWpjfu2y8A HTTP 302
  • https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-zd0svUeroCOCSUKVjb8zA1-5feYaKWpjfu2y8A
Request Chain 242
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w HTTP 303
  • https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=f539a137-8130-4240-8ed0-5ffc143770ff HTTP 302
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=88bfb23d-c3da-4acd-816c-02921b03f189%3A1784686397.5241072&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D88bfb23d-c3da-4acd-816c-02921b03f189%253A1784686397.5241072%26_%3D1784686398.5283608&cb=1784686398.5283775 HTTP 302
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=970033204402624982&referrer=&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3D88bfb23d-c3da-4acd-816c-02921b03f189%253A1784686397.5241072%26_%3D1784686398.5283608 HTTP 302
  • https://idsync.rlcdn.com/501709.gif?partner_uid=88bfb23d-c3da-4acd-816c-02921b03f189%3A1784686397.5241072&_=1784686398.5283608 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESENb7iBO2lNnHfmO3fRAr2gM&google_cver=1
Request Chain 255
  • https://eb2.3lift.com/xuid?mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b HTTP 302
  • https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b&gdpr=0&cmp_cs=&us_privacy=
Request Chain 256
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ HTTP 302
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ?zcc=1&cb=1784686401988 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-1b95fd8e-4332-417d-a7db-43e208598e25-005
Request Chain 258
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzbWVkSnl3Zw HTTP 302
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Request Chain 259
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 302
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Request Chain 260
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=15243275-ad18-4ec1-a16c-6e2b4f4b6bd4 HTTP 302
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync HTTP 302
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile_id%7D%26tag_format%3Dimg%26tag_action%3Dsync%26cb%3D%24%7Brandom%7D HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=898704791 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=vxsrv3i&ttd_tpi=1 HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=10ca1bb6-95f7-4722-a1e9-cf79bafb892e&tag_format=img&tag_action=sync&cb= HTTP 302
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb63d3b0-8572-11f1-906f-d97bef1a9b9b HTTP 302
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 307
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_retry=true HTTP 307
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=f6676a60-2746-4200-bb76-e20a5d99875a&tag_format=img&tag_action=sync HTTP 302
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1 HTTP 303
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=93
Request Chain 263
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=IiKspV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCRGg0eDVUMCUyQkNUSVNUZktNd04yRk0&gdpr=0&gdpr_consent=&lac=y
Request Chain 266
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w HTTP 303
  • https://x.bidswitch.net/sync?ssp=liveintent&user_id=f539a137-8130-4240-8ed0-5ffc143770ff HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=liveintent&bsw_param=5c7324c3-bfde-42fe-9aab-48b387228531&google_hm=NWM3MzI0YzMtYmZkZS00MmZlLTlhYWItNDhiMzg3MjI4NTMx&gdpr_consent=&gdpr= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEC0e9gyBpid3Sflz1Hc9MOo&google_cver=1&ssp=liveintent&bsw_param=5c7324c3-bfde-42fe-9aab-48b387228531&gdpr_consent=&gdpr= HTTP 302
  • https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=5c7324c3-bfde-42fe-9aab-48b387228531 HTTP 303
  • https://i6.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=5c7324c3-bfde-42fe-9aab-48b387228531
Request Chain 279
  • https://eb2.3lift.com/xuid?mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b HTTP 302
  • https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b&gdpr=0&cmp_cs=&us_privacy=
Request Chain 280
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ HTTP 302
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ?zcc=1&cb=1784686402026 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
Request Chain 282
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzbWVkSnl3Zw HTTP 302
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Request Chain 283
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 302
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Request Chain 284
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=eaaf9c63-87e8-444d-9bf2-e53e5f24bfb2 HTTP 302
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync HTTP 302
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile_id%7D%26tag_format%3Dimg%26tag_action%3Dsync%26cb%3D%24%7Brandom%7D HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=474250927 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=vxsrv3i&ttd_tpi=1 HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=7e81865b-5609-4081-ac6d-6aa472eb1942&tag_format=img&tag_action=sync&cb= HTTP 302
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb7e1270-8572-11f1-aea3-d335cdb6ce5b HTTP 302
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 307
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_retry=true HTTP 307
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=3c956a60-2746-4c00-b354-e6273e36baed&tag_format=img&tag_action=sync HTTP 302
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1 HTTP 303
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=68
Request Chain 287
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=TnMAY19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVEYXhHY1ViaGlJSUU4JTJGaiUyQmhROHAxYQ&gdpr=0&gdpr_consent=&lac=y
Request Chain 290
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w HTTP 303
  • https://b1sync.zemanta.com/usersync/liveintent/?cb=//i.liadm.com/s/35004?bidder_id%3D98254%26bidder_uuid%3D__ZUID__
Request Chain 304
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
Request Chain 306
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzbWVkSnl3Zw HTTP 302
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Request Chain 307
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 302
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Request Chain 308
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=243e7f8e-3496-4ca6-9571-cd36f0fc1a82 HTTP 302
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync HTTP 302
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile_id%7D%26tag_format%3Dimg%26tag_action%3Dsync%26cb%3D%24%7Brandom%7D HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=354664970 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=vxsrv3i&ttd_tpi=1 HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=7e81865b-5609-4081-ac6d-6aa472eb1942&tag_format=img&tag_action=sync&cb= HTTP 302
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb8df0f0-8572-11f1-a3f7-0bef8b7b55cd HTTP 302
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 307
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_retry=true HTTP 307
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=89086a60-2746-4100-8399-970d0fadd8ef&tag_format=img&tag_action=sync HTTP 302
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1 HTTP 303
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=84
Request Chain 311
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=egLyTl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCU3phQmVRWTJ2VE83QXNnN1Rjc2o2&gdpr=0&gdpr_consent=&lac=y
Request Chain 314
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w HTTP 303
  • https://dpm.demdex.net/ibs:dpid=127444&dpuuid=f539a137-8130-4240-8ed0-5ffc143770ff
Request Chain 328
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
Request Chain 330
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzbWVkSnl3Zw HTTP 302
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Request Chain 331
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 302
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Request Chain 332
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=b9c2c807-c537-4a97-96fe-7298a1bcf364 HTTP 302
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync HTTP 302
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile_id%7D%26tag_format%3Dimg%26tag_action%3Dsync%26cb%3D%24%7Brandom%7D HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=129089725 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=vxsrv3i&ttd_tpi=1 HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=7e81865b-5609-4081-ac6d-6aa472eb1942&tag_format=img&tag_action=sync&cb= HTTP 302
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb9b5e70-8572-11f1-9363-a1ee2bd1f277 HTTP 302
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 307
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_retry=true HTTP 307
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=3c956a60-2746-4c00-b354-e6273e36baed&tag_format=img&tag_action=sync HTTP 302
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1 HTTP 303
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=21
Request Chain 335
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=2kP7EF9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBWU9XdVBidGVjVmhoV2VYTyUyQlUlMkJidg&gdpr=0&gdpr_consent=&lac=y
Request Chain 338
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w HTTP 303
  • https://sync.srv.stackadapt.com/sync?nid=307 HTTP 302
  • https://i.liadm.com/s/89249?bidder_id=246504&bidder_uuid=9FNJj6QeUdlKp0Ox6m71JpovESo HTTP 303
  • https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=968c7bfbc7b7d3007143abb9bc724330&k=zeta-data-cloud-ca-pixel-5753 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3181&partner_device_id=88bfb23d-c3da-4acd-816c-02921b03f189:1784686397.5241072 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3181&partner_device_id=88bfb23d-c3da-4acd-816c-02921b03f189:1784686397.5241072
Request Chain 352
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
Request Chain 354
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzbWVkSnl3Zw HTTP 302
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Request Chain 355
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 302
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Request Chain 356
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=2dc4f7f0-36e7-4b66-950c-a5709ad3cea7 HTTP 302
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync HTTP 302
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile_id%7D%26tag_format%3Dimg%26tag_action%3Dsync%26cb%3D%24%7Brandom%7D HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=783739093 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1 HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=7e81865b-5609-4081-ac6d-6aa472eb1942&tag_format=img&tag_action=sync&cb= HTTP 302
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb9480a0-8572-11f1-906f-d97bef1a9b9b HTTP 302
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync HTTP 307
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_retry=true HTTP 307
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3Dsync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync HTTP 302
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=f6676a60-2746-4200-bb76-e20a5d99875a&tag_format=img&tag_action=sync HTTP 302
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1 HTTP 303
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=22
Request Chain 359
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=It3gM19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDRXdDb28zSE5jZER2d2IxNlRBVkR0&gdpr=0&gdpr_consent=&lac=y
Request Chain 362
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w HTTP 303
  • https://px.ads.linkedin.com/db_sync?pid=16261&puuid=f539a137-8130-4240-8ed0-5ffc143770ff&rand=1784686403 HTTP 302
  • https://px.ads.linkedin.com/db_sync?pid=16261&puuid=f539a137-8130-4240-8ed0-5ffc143770ff&rand=1784686403&expected_cookie=cfb0fa39-291c-476e-b645-97021b8d8ea2
Request Chain 376
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
Request Chain 380
  • https://ad.360yield.com/match?publisher_dsp_id=42&external_user_id=1900642661338238831&Expiration=1785895997 HTTP 302
  • https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=1900642661338238831&Expiration=1785895997
Request Chain 386
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=1900642661338238831 HTTP 302
  • https://csync.loopme.me/?partner_id=1196&uid=1254a2ec-5c6d-429f-9422-1000d186be0e&vt=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Request Chain 389
  • https://ps.eyeota.net/match?uid=1900642661338238831&bid=9gdtmu1 HTTP 302
  • https://ps.eyeota.net/match/bounce/?uid=1900642661338238831&bid=9gdtmu1
Request Chain 390
  • https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=1900642661338238831 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=1900642661338238831&xl8blockcheck=1 HTTP 302
  • https://load77.exelator.com/pixel.gif
Request Chain 391
  • https://idsync.rlcdn.com/398366.gif?partner_uid=1900642661338238831 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CJ6oGBIeChoIARCUdRoTMTkwMDY0MjY2MTMzODIzODgzMRAAGg0Iwc6A0wYSBQjoBxAAQgBKAA HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=221dff5b863f29b14b2746291c7b7aa2ff940de24a507e5c2f2740955ec464d0791426b5417dce21&_=2
Request Chain 394
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_cm&google_ula=1641347&party=1&google_hm=MTkwMDY0MjY2MTMzODIzODgzMQ&process_consent=T HTTP 302
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEG3rRNb8FRqdUPKajrDPJuU&google_cver=1&google_ula=1641347,0
Request Chain 395
  • https://secure.adnxs.com/getuid?https://c1.adform.net/serving/cookie/match?party=3&id=$UID&redirect=1 HTTP 302
  • https://c1.adform.net/serving/cookie/match?party=3&id=616405946471127822&redirect=1 HTTP 302
  • https://secure.adnxs.com/setuid?entity=91&code=1900642661338238831
Request Chain 400
  • https://dpm.demdex.net/ibs:dpid=1586&dpuuid=1900642661338238831&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredirect%3D1 HTTP 302
  • https://c1.adform.net/serving/cookie/match?party=1007&cid=34890661687262767462851519540925295226&noredirect=1
Request Chain 417
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=2&user_id=faecac79-d534-4812-a6bb-ea036e742c6a&cb=03a71994-3807-40a3-9b7e-c9eced0c4065 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Request Chain 418
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=2&user_id=faecac79-d534-4812-a6bb-ea036e742c6a&cb=0899d081-acd4-4c20-b190-c50975bb1e5f HTTP 302
  • https://ad.360yield.com/match?publisher_dsp_id=191&external_user_id=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent= HTTP 302
  • https://ad.360yield.com/ul_cb/match?publisher_dsp_id=191&external_user_id=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=
Request Chain 419
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=2&user_id=faecac79-d534-4812-a6bb-ea036e742c6a&cb=a551eb92-9bec-408a-8bcd-03f0737bbcbd HTTP 302
  • https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=&us_privacy=
Request Chain 420
  • https://x.bidswitch.net/syncd?dsp_id=409&user_id=faecac79-d534-4812-a6bb-ea036e742c6a&user_group=2&redir=%2F%2Fuse.sportradarserving.com%2Fbsw_sync%3Fbsw_uid%3D%24%7BBSW_UID%7D HTTP 302
  • https://use.sportradarserving.com/bsw_sync?bsw_uid=1254a2ec-5c6d-429f-9422-1000d186be0e
Request Chain 423
  • https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=28645&dpuuid=VBwHDl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDb1RwaEZkUnJwNlRQQSUyRmdRaUVxYmc
Request Chain 425
  • https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=28645&dpuuid=yOLmFV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDcndMT1VmeW5lbDFvWFVqakR3ZDdz
Request Chain 427
  • https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=28645&dpuuid=459dPF9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCTVFiMFJJQXYwb2dTTDY0cTRaVVJE
Request Chain 428
  • https://gum.criteo.com/sync?c=9&r=1&a=1&u=https%3A%2F%2Faa.agkn.com%2Fadscores%2Fg.pixel%3Fsid%3D9212273938%26ct%3D%40USERID%40 HTTP 302
  • https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=tuhjv19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCWE1rNUNNRW0xWU5MSmtyZFZRb1E0
Request Chain 429
  • https://gum.criteo.com/sync?c=9&r=1&a=1&u=https%3A%2F%2Faa.agkn.com%2Fadscores%2Fg.pixel%3Fsid%3D9212273938%26ct%3D%40USERID%40 HTTP 302
  • https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=tAfbuV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDWTl2RVVkdUhTckhRR1UwY0ZWa0Rz
Request Chain 430
  • https://gum.criteo.com/sync?c=9&r=1&a=1&u=https%3A%2F%2Faa.agkn.com%2Fadscores%2Fg.pixel%3Fsid%3D9212273938%26ct%3D%40USERID%40 HTTP 302
  • https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=sqsvUl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBSCUyRmhpJTJGVDJLTUtTR09vSHJ6dk5ZMQ

439 HTTP transactions
2 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H2
200
login Show response
mafiacasino.com/
Redirect Chain
  • http://tr.mafiacasino.com/pub/go/rMSJn/-cD4R
  • https://tr.mafiacasino.com/pub/go/rMSJn/-cD4R
  • https://oafiaca5inuo.com/login
  • https://mafiacasino.com/login
157 KB
24 KB
126ms
47ms
Document
text/html
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
83ad68484efd2672d61bd21a11fb2b44d085f22b31aef56e7a8852fe718a70a2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36

Response headers

age
173
alt-svc
h3=":443"; ma=86400
cache-control
s-maxage=86400
cf-cache-status
HIT
cf-ray
a1eeecc2b9ea92c6-YYZ
cf-ttl
1784686279118
cf-vary
accept-encoding
content-encoding
br
content-type
text/html
date
Wed, 22 Jul 2026 02:13:12 GMT
last-modified
Fri, 17 Jul 2026 13:49:56 GMT
server
cloudflare
vary
accept-encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-ray
a1eeecc1fc4e61e8-YYZ
content-length
0
date
Wed, 22 Jul 2026 02:13:12 GMT
location
https://mafiacasino.com/login
server
cloudflare
vary
accept-encoding
GET
H2
200
mafia-preloader-bg.webp
mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/
369 KB
370 KB
33ms
30ms
Image
image/webp
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/mafia-preloader-bg.webp
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
79e0c0225f8dfd655ee5fb7580646260339739ff8e131d4b1ec90bc267e4b60b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-conv-cache-status
HIT
cf-cache-status
HIT
etag
"7c446a182597cb3c3b9c2edb460e91ea"
age
561596
expires
Wed, 15 Jul 2026 17:51:43 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
image/webp
last-modified
Wed, 17 Jun 2026 12:36:11 GMT
vary
accept-encoding
cache-control
public, max-age=14400
x-front-cache-status
HIT
cf-ray
a1eeecc35bc692c6-YYZ
accept-ranges
bytes
content-length
377798
server
cloudflare
GET
H2
200
mafia-preloader-bg-mobile.webp
mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/
179 KB
179 KB
52ms
50ms
Image
image/webp
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/mafia-preloader-bg-mobile.webp
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
8dbeacacee80b72b9b83400adfcc6df9302d91e4536866afc1359d13860aa737

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-conv-cache-status
HIT
cf-cache-status
HIT
etag
"20e0caa24b5214a6acc3619af89ecf3b"
age
1282664
expires
Tue, 07 Jul 2026 09:55:27 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
image/webp
last-modified
Wed, 17 Jun 2026 12:36:11 GMT
vary
accept-encoding
cache-control
public, max-age=14400
x-front-cache-status
HIT
cf-ray
a1eeecc35bc892c6-YYZ
accept-ranges
bytes
content-length
182876
server
cloudflare
GET
H2
200
mafia-preloader-text-primary.svg
mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/
8 KB
2 KB
35ms
34ms
Image
image/svg+xml
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/mafia-preloader-text-primary.svg
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
e2f0eaebb9f1a2c9dee387266af5aa705daee896371669046479f9d2bd29f622

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
x-conv-cache-status
HIT
content-encoding
gzip
cf-cache-status
HIT
etag
W/"7caa7ac23bc7e158d1a6fdf05d1e8883"
age
1196905
x-front-cache-status
MISS
cf-ray
a1eeecc37c2d92c6-YYZ
expires
Wed, 08 Jul 2026 09:36:09 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
image/svg+xml
last-modified
Wed, 17 Jun 2026 12:36:09 GMT
server
cloudflare
vary
accept-encoding
GET
H2
200
mafia-preloader-text-secondary.svg
mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/
8 KB
4 KB
34ms
33ms
Image
image/svg+xml
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/mafia-preloader-text-secondary.svg
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
8e6959ab01c9015d667175c58c8f21608c86f1204fe60e8b6723efebfb8a25cf

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
x-conv-cache-status
HIT
content-encoding
gzip
cf-cache-status
HIT
etag
W/"af0bce5cef91c6734801c60abce04a30"
age
1023532
x-front-cache-status
MISS
cf-ray
a1eeecc37c3192c6-YYZ
expires
Fri, 10 Jul 2026 09:54:19 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
image/svg+xml
last-modified
Wed, 17 Jun 2026 12:36:09 GMT
server
cloudflare
vary
accept-encoding
GET
H2
200
runtime.888bd258a7933438.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
7 KB
4 KB
54ms
53ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
6a95037c18c2d68bc331a41a435642fedf969010ad12aeb59b0538f9ae85c73a

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"c6f3976a05242e6ab94b72f54e9127fa"
age
9842
cf-ray
a1eeecc35bbe92c6-YYZ
expires
Wed, 22 Jul 2026 03:29:10 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:42 GMT
server
cloudflare
vary
accept-encoding
GET
H2
200
polyfills.c8c0f3e71e7b8c56.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
34 KB
12 KB
54ms
52ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
5cee0bf7ca742032db248e1fb26e4634e9558479101e612a78efa189d026960f

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"4181af117acce512fbf4d4d2adb080bd"
age
9842
cf-ray
a1eeecc35bc292c6-YYZ
expires
Wed, 22 Jul 2026 03:29:10 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:40 GMT
server
cloudflare
vary
accept-encoding
GET
H2
200
main.2bd32f7164550f10.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
3 MB
741 KB
54ms
54ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/main.2bd32f7164550f10.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
4c9c2adcea0d682be64b984be4680966682da253f1fd0048bc10a7e7a55d6edf

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"dac7f3f7a4b4ad858db6aa769eafb3b2"
age
9842
cf-ray
a1eeecc35bc492c6-YYZ
expires
Wed, 22 Jul 2026 03:29:10 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:40 GMT
server
cloudflare
vary
accept-encoding
GET
H2
200
styles.cf94b092a5853e4f.css
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
326 KB
48 KB
51ms
50ms
Stylesheet
text/css
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/styles.cf94b092a5853e4f.css
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
e8121bc993a627083bd3064aadd3cbd53f463c92d292661d83029e65893c5754

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"14cca01de151e2bb1fb2367d60530545"
age
13875
cf-ray
a1eeecc37c3492c6-YYZ
expires
Wed, 22 Jul 2026 02:21:57 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
text/css
last-modified
Fri, 17 Jul 2026 13:48:43 GMT
server
cloudflare
vary
accept-encoding
GET
H2
200
Yq6R-LCVXSLy9uPBwlATrOF6kg.woff2
fonts.gstatic.com/s/sofiasans/v20/
39 KB
40 KB
155ms
37ms
Font
font/woff2
172.253.115.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/sofiasans/v20/Yq6R-LCVXSLy9uPBwlATrOF6kg.woff2
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f94.1e100.net
Software
sffe /
Resource Hash
2176b732b7e4e2bf32a38335a1ee0a127efef2478266d3ec2ed806edaf9671a8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

age
41245
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 21 Jul 2027 14:45:48 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 21 Jul 2026 14:45:48 GMT
last-modified
Thu, 04 Sep 2025 18:40:13 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
40372
x-xss-protection
0
server
sffe
GET
H3
200
agent.umd.js Show response
cdn.seondf.com/js/v6/
304 KB
118 KB
63ms
31ms
Script
application/javascript
172.67.148.159
Cloudflare
General
Full URL
https://cdn.seondf.com/js/v6/agent.umd.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/main.2bd32f7164550f10.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.148.159 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f7d9d5a786b0591ac59dc2c74cbd1ef298a72f91d74868243c9a446b9bca5c6

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"0d31e3cb685faa361562fa2fa8d07525"
x-amz-version-id
5t8p3kTmZ6JQP6o7kNpIVyNY6liCfu5Q
age
1409
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=r8d%2B3DlQ9CaFLK1SaY6vglK8J0cSVE3FoMoeK02Ui0ZxeG9uHilotGnsv7FaVEB0pZfi60gALkzMjpLoseqjVLYvNzvw9VLhUDdnG4j9FOVstfivj0p%2BCSEf1ujWd8ISSw%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
x-amz-cf-id
iX9BPRV4UT6VjbXE7wy8S2kduMIaJUjyIBY8DQ6lN6MCqjlhl01OUg==
date
Wed, 22 Jul 2026 02:13:13 GMT
content-type
application/javascript
last-modified
Wed, 08 Jul 2026 12:27:09 GMT
vary
Origin
priority
u=3,i=?0
server-timing
cfExtPri
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control
max-age=14400
cross-origin-resource-policy
cross-origin
via
1.1 0ce818e97dfb8e28b0c049775fa034f8.cloudfront.net (CloudFront)
cf-ray
a1eeecc75fe9aa71-YYZ
x-amz-cf-pop
YUL62-P3
server
cloudflare
x-amz-server-side-encryption
AES256
GET
H3
200
info Show response
mafiacasino.com/en/api/v3/project/
268 B
1 KB
165ms
164ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/en/api/v3/project/info?fields=payment
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
a98e85fbae805ef71739d57dbf852a5d7aaf4e1773541718b49085038c2c95d6
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
eUUDPMsZrRsXB2GBViJPvXF4JKqBN1HfZz6m0HE6

Response headers

x-request-id
85901369-0c5b-476c-a234-76152977bde8
content-encoding
br
cf-cache-status
DYNAMIC
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:13 GMT
content-type
application/json; charset=utf-8
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
x-dns-prefetch-control
off
x-envoy-upstream-service-time
6
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecc74854ebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
info Show response
mafiacasino.com/en/api/v3/system/
326 B
2 KB
50ms
50ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/en/api/v3/system/info
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
0dc10c4116a00d68c7d80f081ea8362a91dea4bbd73bea18e63e843fb18afe6f
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-c0c38609387f7bd7598a387e0a714189-a7ebebb4880c46b2-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
UP7_7lb05iZWtR_KlQMa0TdJX0O9CXVxxVUEO36Q

Response headers

x-request-id
9c084106-790a-4529-89e0-2decf241661a
content-encoding
br
cf-cache-status
HIT
age
5212
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
cf-ttl
1784681240710
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:13 GMT
content-type
application/json; charset=utf-8
last-modified
Wed, 22 Jul 2026 00:46:20 GMT
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
cache-control
s-maxage=86400
x-dns-prefetch-control
off
x-envoy-upstream-service-time
9
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecc768caebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
info Show response
mafiacasino.com/en/api/v3/project/
5 KB
2 KB
381ms
380ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/en/api/v3/project/info?fields=languages
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
dc8eadf5c7cd2319dcbcbd609bd96f3e172d237968c79a8638f96b6339ba65e6
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-a30831b6ff30eff2bc5161a094336b59-f4e6b4f0b7ba5cbb-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
EjJit38HCA-uWlIaKCBb8mG8vZMFLKY47ae42Xaa

Response headers

x-request-id
68231c2e-8cff-4347-bac1-36834f6b8998
content-encoding
br
cf-cache-status
DYNAMIC
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:13 GMT
content-type
application/json; charset=utf-8
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
x-dns-prefetch-control
off
x-envoy-upstream-service-time
7
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecc778e1ebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
main.js Show response
mafiacasino.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/3104729c556c/ Frame 2E6A
Redirect Chain
  • https://mafiacasino.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://mafiacasino.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/3104729c556c/main.js?
21 KB
10 KB
28ms
28ms
Script
application/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/3104729c556c/main.js?
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H3
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
b342b8dd693993977cbcd3c2e034dad0497622bdb06325f2015c29cc0e7c4d64
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding
br
x-content-type-options
nosniff
cf-ray
a1eeecc7a96aebb9-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:13 GMT
content-type
application/javascript; charset=UTF-8
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/3104729c556c/main.js?
cf-ray
a1eeecc778e8ebb9-YYZ
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:13 GMT
server
cloudflare
priority
u=3,i=?0
GET

ed3a25f6-13df-41e8-b72f-d57670939aef
https://mafiacasino.com/
0
0


GET

e8f1ee6c-415f-427f-bdf6-2758d0d578ce
https://mafiacasino.com/
0
0


GET

a914f8bc-556d-47de-a424-1a4d7945db4d
https://mafiacasino.com/
0
0


GET

a4eb6e2a-db1f-4e17-8d8a-965817fe0722
https://mafiacasino.com/
0
0


GET

301dd53d-47d6-452e-b7cb-af75c7fb555f
https://mafiacasino.com/
0
0


GET

be313a37-6817-4f00-807a-334027c14918
https://mafiacasino.com/
0
0


GET

1bd76757-29cd-43be-92f1-4a1eb6e12af4
https://mafiacasino.com/
0
0


GET

848c3fae-13a2-410c-b786-2c9847e8bb3c
https://mafiacasino.com/
0
0


GET

8d517b0b-5e8f-4f01-952c-786336102203
https://mafiacasino.com/
0
0


GET

f4475ed2-6d13-463c-98dc-2d7db7b57f30
https://mafiacasino.com/
0
0


GET

278f010c-1032-4dac-9a07-c492cb8409aa
https://mafiacasino.com/
0
0


GET

5e4b7cee-f449-442c-b837-a4fa47cd0070
https://mafiacasino.com/
0
0


GET

9fc8c8e2-24d9-419d-be4f-5314bdddeeec
https://mafiacasino.com/
0
0


GET

ea77766e-c5d2-4298-99b1-844c1b8aab51
https://mafiacasino.com/
0
0


GET

9288bf52-9e73-4c10-b5e7-53affc59153e
https://mafiacasino.com/
0
0


GET

251f94a9-c05d-485f-9200-2e2166d37c15
https://mafiacasino.com/
0
0


GET

283cb316-98e5-44af-9ae2-a010fa6d4225
https://mafiacasino.com/
0
0


GET

a2d4b50b-7be3-4635-8132-044bfbe85475
https://mafiacasino.com/
0
0


POST
H2
200
/ Show response
409423117828234e774a05c21da2005b.seondnsresolve.com/
11 B
161 B
524ms
129ms
XHR
application/json
54.75.32.104
Amazon.com
General
Full URL
https://409423117828234e774a05c21da2005b.seondnsresolve.com/
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.32.104 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-75-32-104.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2d7a270c1928be61476bfe7e9a662b5d23101783e646e0b241b3955ad5ee786f

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
content-length
11
date
Wed, 22 Jul 2026 02:13:14 GMT
content-type
application/json
access-control-allow-credentials
true
access-control-allow-methods
OPTIONS,GET,POST
GET
H/1.1
200
/ Show response
eb6a7d55b667d9b6e52e2ebe363274d7b395eb78.seondnsresolve.com/
800 B
998 B
522ms
125ms
XHR
application/json
34.252.32.161
Amazon.com
General
Full URL
https://eb6a7d55b667d9b6e52e2ebe363274d7b395eb78.seondnsresolve.com/
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.252.32.161 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-252-32-161.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
12383ad34041629b4ee0e8c966f4864c654e4291619daca90d6725757e2d01cc

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
content-length
800
date
Wed, 22 Jul 2026 02:13:14 GMT
content-type
application/json
connection
close
access-control-allow-credentials
true
GET
DATA
200
OK
truncated
/
88 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
87a06d50a2e60f0f2fa9957322630c869ea00dfc13b6d462a7967bb3ffb0cffc

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
POST

a1eeecc2b9ea92c6
mafiacasino.com/cdn-cgi/challenge-platform/h/b/jsd/oneshot/3104729c556c/0.47982491241757264:1784682620:y2nGJhuO_3Ull-gh6e_yB5JfpnvKC_aaLxfiil8OcKI/ Frame 2E6A
0
0


GET
H3
200
Primary Request login Show response
mafiacasino.com/ca/
157 KB
24 KB
43ms
43ms
Document
text/html
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/login
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/main.2bd32f7164550f10.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
1ea544a14c010c9664d34c64ed9a973cba64a09d15e9451663d46484842efa3d

Request headers

Referer
https://mafiacasino.com/login
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

age
1
alt-svc
h3=":443"; ma=86400
cache-control
s-maxage=86400
cf-cache-status
HIT
cf-ray
a1eeeccc7814ebb9-YYZ
cf-ttl
1784686452956
cf-vary
accept-encoding
content-encoding
br
content-type
text/html
date
Wed, 22 Jul 2026 02:13:14 GMT
last-modified
Fri, 17 Jul 2026 13:49:56 GMT
priority
u=0,i
server
cloudflare
server-timing
cfExtPri
vary
accept-encoding
GET
H3
304
mafia-preloader-bg.webp
mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/
369 KB
275 B
30ms
29ms
Image
image/webp
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/mafia-preloader-bg.webp
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/ca/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
If-None-Match
"7c446a182597cb3c3b9c2edb460e91ea"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
If-Modified-Since
Wed, 17 Jun 2026 12:36:11 GMT
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
x-conv-cache-status
HIT
cf-cache-status
HIT
etag
"7c446a182597cb3c3b9c2edb460e91ea"
age
561598
x-front-cache-status
HIT
cf-ray
a1eeeccdeccdebb9-YYZ
expires
Wed, 15 Jul 2026 17:51:43 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:14 GMT
last-modified
Wed, 17 Jun 2026 12:36:11 GMT
vary
accept-encoding
server
cloudflare
priority
u=2,i
GET
H3
304
mafia-preloader-bg-mobile.webp
mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/
179 KB
274 B
34ms
33ms
Image
image/webp
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/mafia-preloader-bg-mobile.webp
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/ca/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
If-None-Match
"20e0caa24b5214a6acc3619af89ecf3b"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
If-Modified-Since
Wed, 17 Jun 2026 12:36:11 GMT
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
x-conv-cache-status
HIT
cf-cache-status
HIT
etag
"20e0caa24b5214a6acc3619af89ecf3b"
age
1282666
x-front-cache-status
HIT
cf-ray
a1eeeccdecceebb9-YYZ
expires
Tue, 07 Jul 2026 09:55:27 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:14 GMT
last-modified
Wed, 17 Jun 2026 12:36:11 GMT
vary
accept-encoding
server
cloudflare
priority
u=2,i
GET
H3
304
mafia-preloader-text-primary.svg
mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/
8 KB
278 B
29ms
28ms
Image
image/svg+xml
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/mafia-preloader-text-primary.svg
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/ca/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
If-None-Match
W/"7caa7ac23bc7e158d1a6fdf05d1e8883"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
If-Modified-Since
Wed, 17 Jun 2026 12:36:09 GMT
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
x-conv-cache-status
HIT
cf-cache-status
HIT
etag
W/"7caa7ac23bc7e158d1a6fdf05d1e8883"
age
1196907
x-front-cache-status
MISS
cf-ray
a1eeecce1d45ebb9-YYZ
expires
Wed, 08 Jul 2026 09:36:09 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:14 GMT
last-modified
Wed, 17 Jun 2026 12:36:09 GMT
vary
accept-encoding
server
cloudflare
priority
u=2,i
GET
H3
304
mafia-preloader-text-secondary.svg
mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/
8 KB
277 B
31ms
29ms
Image
image/svg+xml
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/rimg/67ee6c8b41bd0d4d00c98e96/mafia-preloader-text-secondary.svg
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/ca/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
If-None-Match
W/"af0bce5cef91c6734801c60abce04a30"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
If-Modified-Since
Wed, 17 Jun 2026 12:36:09 GMT
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
x-conv-cache-status
HIT
cf-cache-status
HIT
etag
W/"af0bce5cef91c6734801c60abce04a30"
age
1023534
x-front-cache-status
MISS
cf-ray
a1eeecce1d4cebb9-YYZ
expires
Fri, 10 Jul 2026 09:54:19 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:14 GMT
last-modified
Wed, 17 Jun 2026 12:36:09 GMT
vary
accept-encoding
server
cloudflare
priority
u=2,i
GET
H2
200
runtime.888bd258a7933438.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
7 KB
0
54ms
53ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/ca/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
6a95037c18c2d68bc331a41a435642fedf969010ad12aeb59b0538f9ae85c73a

Request headers

Origin
https://mafiacasino.com
Referer
https://mafiacasino.com/ca/login

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"c6f3976a05242e6ab94b72f54e9127fa"
age
9842
cf-ray
a1eeecc35bbe92c6-YYZ
expires
Wed, 22 Jul 2026 03:29:10 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:42 GMT
server
cloudflare
vary
accept-encoding
GET
H2
200
polyfills.c8c0f3e71e7b8c56.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
34 KB
0
54ms
52ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/ca/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
5cee0bf7ca742032db248e1fb26e4634e9558479101e612a78efa189d026960f

Request headers

Origin
https://mafiacasino.com
Referer
https://mafiacasino.com/ca/login

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"4181af117acce512fbf4d4d2adb080bd"
age
9842
cf-ray
a1eeecc35bc292c6-YYZ
expires
Wed, 22 Jul 2026 03:29:10 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:40 GMT
server
cloudflare
vary
accept-encoding
GET
H2
200
main.2bd32f7164550f10.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
3 MB
0
54ms
54ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/main.2bd32f7164550f10.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/ca/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
4c9c2adcea0d682be64b984be4680966682da253f1fd0048bc10a7e7a55d6edf

Request headers

Origin
https://mafiacasino.com
Referer
https://mafiacasino.com/ca/login

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"dac7f3f7a4b4ad858db6aa769eafb3b2"
age
9842
cf-ray
a1eeecc35bc492c6-YYZ
expires
Wed, 22 Jul 2026 03:29:10 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:40 GMT
server
cloudflare
vary
accept-encoding
GET
H2
200
styles.cf94b092a5853e4f.css
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
326 KB
0
51ms
50ms
Stylesheet
text/css
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/styles.cf94b092a5853e4f.css
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/ca/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
e8121bc993a627083bd3064aadd3cbd53f463c92d292661d83029e65893c5754

Request headers

Referer
https://mafiacasino.com/ca/login

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"14cca01de151e2bb1fb2367d60530545"
age
13875
cf-ray
a1eeecc37c3492c6-YYZ
expires
Wed, 22 Jul 2026 02:21:57 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:12 GMT
content-type
text/css
last-modified
Fri, 17 Jul 2026 13:48:43 GMT
server
cloudflare
vary
accept-encoding
GET
H2
200
Yq6R-LCVXSLy9uPBwlATrOF6kg.woff2
fonts.gstatic.com/s/sofiasans/v20/
39 KB
0
155ms
37ms
Font
font/woff2
172.253.115.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/sofiasans/v20/Yq6R-LCVXSLy9uPBwlATrOF6kg.woff2
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/ca/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f94.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://mafiacasino.com
Referer
https://mafiacasino.com/

Response headers

age
41245
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 21 Jul 2027 14:45:48 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 21 Jul 2026 14:45:48 GMT
last-modified
Thu, 04 Sep 2025 18:40:13 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
40372
x-xss-protection
0
server
sffe
GET
H3
200
agent.umd.js Show response
cdn.seondf.com/js/v6/
304 KB
0
63ms
31ms
Script
application/javascript
172.67.148.159
Cloudflare
General
Full URL
https://cdn.seondf.com/js/v6/agent.umd.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/main.2bd32f7164550f10.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.148.159 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f7d9d5a786b0591ac59dc2c74cbd1ef298a72f91d74868243c9a446b9bca5c6

Request headers

Referer
https://mafiacasino.com/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"0d31e3cb685faa361562fa2fa8d07525"
x-amz-version-id
5t8p3kTmZ6JQP6o7kNpIVyNY6liCfu5Q
age
1409
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=r8d%2B3DlQ9CaFLK1SaY6vglK8J0cSVE3FoMoeK02Ui0ZxeG9uHilotGnsv7FaVEB0pZfi60gALkzMjpLoseqjVLYvNzvw9VLhUDdnG4j9FOVstfivj0p%2BCSEf1ujWd8ISSw%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
x-amz-cf-id
iX9BPRV4UT6VjbXE7wy8S2kduMIaJUjyIBY8DQ6lN6MCqjlhl01OUg==
date
Wed, 22 Jul 2026 02:13:13 GMT
content-type
application/javascript
last-modified
Wed, 08 Jul 2026 12:27:09 GMT
vary
Origin
priority
u=3,i=?0
server-timing
cfExtPri
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control
max-age=14400
cross-origin-resource-policy
cross-origin
via
1.1 0ce818e97dfb8e28b0c049775fa034f8.cloudfront.net (CloudFront)
cf-ray
a1eeecc75fe9aa71-YYZ
x-amz-cf-pop
YUL62-P3
server
cloudflare
x-amz-server-side-encryption
AES256
GET
H3
200
info Show response
mafiacasino.com/ca/api/v3/project/
268 B
1 KB
154ms
153ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/project/info?fields=payment
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
a98e85fbae805ef71739d57dbf852a5d7aaf4e1773541718b49085038c2c95d6
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
S18dvb650T25t_-Y5G2h6JTeHKkvVRT7SZItaTR1

Response headers

x-request-id
8033d834-c915-41da-a625-a0f808fa6ae9
content-encoding
br
cf-cache-status
DYNAMIC
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:14 GMT
content-type
application/json; charset=utf-8
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
x-dns-prefetch-control
off
x-envoy-upstream-service-time
7
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeeccfda32ebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
info Show response
mafiacasino.com/ca/api/v3/system/
326 B
2 KB
58ms
57ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/system/info
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
1a3e18cff8c54c58285c75e6535932847b756833a5a4f76585bb8c3ca116aa22
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-de9d3b526c71e9b99a1b50e04c36527c-6cc5cbd03ca6ba44-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
X5vpTF5qzjUdTig4ctbu2ZzKAuU3Aweip7YvP62w

Response headers

x-request-id
b960cdf3-be25-4691-8ebd-e5070c253e8e
content-encoding
br
cf-cache-status
HIT
age
102
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
cf-ttl
1784686352591
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:14 GMT
content-type
application/json; charset=utf-8
last-modified
Wed, 22 Jul 2026 02:11:32 GMT
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
cache-control
s-maxage=86400
x-dns-prefetch-control
off
x-envoy-upstream-service-time
7
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeeccfea7debb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
info Show response
mafiacasino.com/en/api/v3/project/
5 KB
2 KB
38ms
38ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/en/api/v3/project/info?fields=languages
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
dc8eadf5c7cd2319dcbcbd609bd96f3e172d237968c79a8638f96b6339ba65e6
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-a987e0d69963663171ddf97d64c87908-c0c9a38f0818483b-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
uBaSzcR7JuWq-61EfTEdMao9pL4FI8b7eKXDZrYm

Response headers

x-request-id
68231c2e-8cff-4347-bac1-36834f6b8998
content-encoding
br
cf-cache-status
HIT
age
1
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
cf-ttl
1784686453860
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:14 GMT
content-type
application/json; charset=utf-8
last-modified
Wed, 22 Jul 2026 02:13:13 GMT
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
cache-control
s-maxage=300
x-dns-prefetch-control
off
x-envoy-upstream-service-time
7
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeeccfea8bebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
main.js Show response
mafiacasino.com/cdn-cgi/challenge-platform/scripts/jsd/ Frame 2FC4
21 KB
0
28ms
28ms
Script
application/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H3
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
b342b8dd693993977cbcd3c2e034dad0497622bdb06325f2015c29cc0e7c4d64
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding
br
x-content-type-options
nosniff
cf-ray
a1eeecc7a96aebb9-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:13 GMT
content-type
application/javascript; charset=UTF-8
server
cloudflare
priority
u=3,i=?0
POST
H3
200
a1eeeccc7814ebb9 Show response
mafiacasino.com/cdn-cgi/challenge-platform/h/b/jsd/oneshot/3104729c556c/0.47982491241757264:1784682620:y2nGJhuO_3Ull-gh6e_yB5JfpnvKC_aaLxfiil8OcKI/ Frame 2FC4
0
872 B
43ms
40ms
XHR
text/plain
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cdn-cgi/challenge-platform/h/b/jsd/oneshot/3104729c556c/0.47982491241757264:1784682620:y2nGJhuO_3Ull-gh6e_yB5JfpnvKC_aaLxfiil8OcKI/a1eeeccc7814ebb9
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
https://mafiacasino.com
cf-ray
a1eeecd10de9ebb9-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
0
cf-chl-out-s
fTm92iJg9jHm+AHNdSjgiw==$xvIsv0Ayay8J8jfU8qyJcw==
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
priority
u=1,i
GET
H3
200
info Show response
mafiacasino.com/ca/api/v3/project/
1 KB
2 KB
196ms
196ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/project/info?fields=client,sportsbook,registration,login,defaultCurrency,payment
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
33029abbea89c1de8f74db1d2a33891e1dbab78f8a0eb67176ecf737597aa244
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-c7d3beda9ee873a693d6a330b45bfa69-5921f3fe4d91f64a-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
itz3Nl6xmvxF2aU3CG__XVRgiKAmwWZSL8K-X493

Response headers

x-request-id
9e28bc78-951d-45ac-be7e-f236698b84f0
content-encoding
br
cf-cache-status
DYNAMIC
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json; charset=utf-8
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
x-dns-prefetch-control
off
x-envoy-upstream-service-time
28
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecd10e0eebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
info Show response
mafiacasino.com/ca/api/v3/project/
583 B
2 KB
179ms
179ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/project/info?fields=brandOnboarding,gamificationWithdrawal,shorts,spinRally,jackpot,chat,multiLevelVipProgram,rebates,gamificationWidgetLoader,feedSettings,quests,worldCup
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
4a30c50595cddc4c4bcb7c893321b11795a045326f35f913500ec56bcc83ea96
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-7fdb429a6fd1502757569747a4ab3729-97a2412718e63884-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
rx902XxeCSkA5IxfsLPMTRBtYPdeuYSb0m-j0YQo

Response headers

x-request-id
a64c459a-fcf3-4664-93c5-71ed7aa568c8
content-encoding
br
cf-cache-status
DYNAMIC
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json; charset=utf-8
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
x-dns-prefetch-control
off
x-envoy-upstream-service-time
17
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecd11e1bebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
info Show response
mafiacasino.com/ca/api/v3/project/
984 B
2 KB
177ms
177ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/project/info?fields=recommendedPopup,liveThumbnails,actionTriggers,pickGameOnBonusActivation,checkWageringRestriction,transaction,xDefaultLanguage
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
ea99c0a9cefa49b6d0e2ec4898b7ac2b26e01d9ccf80faecd0de04ad28e6e701
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-90a3891f92814472909dee63d603f37b-b336b0e89f420a1e-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
UDW0RSBXxDc1PKPFjDkBk87zcmTf1jV18J3LrnB9

Response headers

x-request-id
b120500f-02da-49d6-b02f-54bbd26e138f
content-encoding
br
cf-cache-status
DYNAMIC
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json; charset=utf-8
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
x-dns-prefetch-control
off
x-envoy-upstream-service-time
5
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecd11e25ebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
info Show response
mafiacasino.com/ca/api/v3/project/
127 B
1 KB
167ms
166ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/project/info?fields=displayIgocseBanners
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
1041e962a25a4980aa80a2bf9857b9305b9855419798492f624db89b1b667c55
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-30d747d8459c03e630c9d73f0bd46eb6-af98417b42fba941-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
yJhqGztMyDsM-zVLPOThp6G8qherwUnFV21ZiGHe

Response headers

x-request-id
bc0ddfea-82d2-4896-a904-b6066b8a112b
content-encoding
br
cf-cache-status
DYNAMIC
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json; charset=utf-8
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
x-dns-prefetch-control
off
x-envoy-upstream-service-time
5
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecd11e2debb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET

fff62ec8-c36a-456a-a7af-e34deaf8f181
https://mafiacasino.com/
0
0


GET

48d6ad93-75d6-43a7-8594-34e8305ac2ee
https://mafiacasino.com/
0
0


GET

5df72d05-e0ad-452d-8131-4b22f0219bb4
https://mafiacasino.com/
0
0


GET

42f86efd-81f3-4158-81b7-3af9d0d2ccbd
https://mafiacasino.com/
0
0


GET

d5af0acd-b80b-41aa-a0da-c9816adba365
https://mafiacasino.com/
0
0


GET

cb341c79-564a-4e48-86f8-df1818a69f40
https://mafiacasino.com/
0
0


GET

e921e941-7ea8-425b-a80f-fc38b8055bac
https://mafiacasino.com/
0
0


GET

2d38ae31-a040-4831-a4d2-591947e66f23
https://mafiacasino.com/
0
0


GET

7596bd1c-35ac-4168-84f8-59abf64ada33
https://mafiacasino.com/
0
0


GET

cfd9258e-c04d-4219-8c1d-86e0766fe994
https://mafiacasino.com/
0
0


GET

d8ef0268-cb81-466d-9917-e727440169cd
https://mafiacasino.com/
0
0


GET

86f1b53e-1a7d-4db2-8526-4291e60578dc
https://mafiacasino.com/
0
0


GET

40eb1cd9-98c4-4067-aa7c-e27573ae5234
https://mafiacasino.com/
0
0


GET

0c77ddbc-89f0-48b2-aab6-811dbe434082
https://mafiacasino.com/
0
0


GET

6e91f8b6-f8a8-4e72-bf11-1ae25b76d4f7
https://mafiacasino.com/
0
0


GET

3db731a3-8985-46be-b40a-1dcb62dc2df8
https://mafiacasino.com/
0
0


GET

f23d32e7-9eff-49f4-8e81-4b762f8069b6
https://mafiacasino.com/
0
0


GET

bab2af94-a311-40a6-871f-19bf8652cb03
https://mafiacasino.com/
0
0


POST
H2
200
/ Show response
0425ce576b70653b18f084f63cc38c29.seondnsresolve.com/
11 B
160 B
285ms
134ms
XHR
application/json
54.75.32.104
Amazon.com
General
Full URL
https://0425ce576b70653b18f084f63cc38c29.seondnsresolve.com/
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.32.104 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-75-32-104.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2d7a270c1928be61476bfe7e9a662b5d23101783e646e0b241b3955ad5ee786f

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
content-length
11
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json
access-control-allow-credentials
true
access-control-allow-methods
OPTIONS,GET,POST
GET
H/1.1
200
/ Show response
eb6a7d55b667d9b6e52e2ebe363274d7b395eb78.seondnsresolve.com/
800 B
998 B
365ms
122ms
XHR
application/json
34.252.32.161
Amazon.com
General
Full URL
https://eb6a7d55b667d9b6e52e2ebe363274d7b395eb78.seondnsresolve.com/
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.252.32.161 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-252-32-161.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
b1dd91cfa6ea0b73f3c7e496140cb7fc515fb94b365786d3184a23af58afddec

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
content-length
800
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json
connection
close
access-control-allow-credentials
true
GET
DATA
200
OK
truncated
/
88 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
87a06d50a2e60f0f2fa9957322630c869ea00dfc13b6d462a7967bb3ffb0cffc

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
GET
H3
200
collection Show response
mafiacasino.com/ca/api/v3/casino/
537 B
2 KB
75ms
75ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/casino/collection
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
c091ee830bf4d125b2bdba1718cd9d690e830b10026ad7ee81cf77c51f741901
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-8ef66816d247ffd1db5e3c6c2ed5ca6c-794072cb973a4c42-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
pux7fPdRf3n86-ZX5m6cKh5wKrGUB6fOJ5VhTRib

Response headers

x-request-id
6bd3238f-f546-43a0-8e26-021b678a2643
content-encoding
br
cf-cache-status
HIT
age
100
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
cf-ttl
1784686305085
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json; charset=utf-8
last-modified
Wed, 22 Jul 2026 02:11:35 GMT
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
cache-control
s-maxage=300
x-dns-prefetch-control
off
x-envoy-upstream-service-time
25
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecd4d9f0ebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
POST
H3
200
translation Show response
mafiacasino.com/ca/api/v3/lang/
110 KB
32 KB
270ms
269ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/lang/translation
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
f1bc6367f745923470831c645e19f648616fe0ec1a86ee66363c3b7851e945e6
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-fb3191317674f5215b8055a533857722-87f760a552c3eb6f-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
D1jj1p3t4bsYDWGzTaXPsD_uRoFxpwSQnAxyOIka
Content-Type
application/json

Response headers

x-request-id
ccaae17c-d908-434f-88f8-176df23122b0
content-encoding
br
cf-cache-status
DYNAMIC
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json; charset=utf-8
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
x-dns-prefetch-control
off
x-envoy-upstream-service-time
91
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecd4ea06ebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
common.dac3a68f454b7309.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
120 KB
30 KB
75ms
74ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/common.dac3a68f454b7309.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
93cd5bf9a9825c02400b3efda66019407e773cc8a8681e7029abdbc81b5d58a1

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"1e4ad11f984075934dee71beb1cbf843"
age
9843
cf-ray
a1eeecd4fa61ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:38 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
7792.c14d715333d58d61.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
4 KB
2 KB
111ms
110ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/7792.c14d715333d58d61.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
1538cd8aed8cb98c0e07603551ccab69c48f771ee3e258edd09af7c2bca0ecc7

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"94f159e968b6b50bbe4aec315e56856f"
age
9843
cf-ray
a1eeecd4fa65ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
item Show response
mafiacasino.com/ca/api/v3/seo/
1 KB
2 KB
72ms
71ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/seo/item?page=home
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
a6cbda300a5e48a41a22961afe76b5775d75471b31edb4c5b05d0deae04da660
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-81297d8dd9931db08e8f09f76ee82b31-146c5688bd610dd6-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
yYYh1gJ5bQGm2IfLQeoP7L4LxXb0eId7JCdUpkfF

Response headers

x-request-id
f4ddca55-f446-439b-9000-411eb8c1e2e4
content-encoding
br
cf-cache-status
HIT
age
100
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
cf-ttl
1784686305274
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json; charset=utf-8
last-modified
Wed, 22 Jul 2026 02:11:35 GMT
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
cache-control
s-maxage=300
x-dns-prefetch-control
off
x-envoy-upstream-service-time
6
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecd4fa68ebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H2
200
gtm.js Show response
www.googletagmanager.com/
410 KB
134 KB
182ms
88ms
Script
application/javascript
142.251.163.97
Google LLC
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-K6B6C44T
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/main.2bd32f7164550f10.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.97 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
wv-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
3ef28a40c85699c2cb3afd8ba17113a35b2de8357e8215bf4782dde20636d8f7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-encoding
zstd
expires
Wed, 22 Jul 2026 02:13:15 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Wed, 22 Jul 2026 00:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
136833
x-xss-protection
0
server
Google Tag Manager
GET
H3
200
info Show response
mafiacasino.com/ca/api/v3/project/
622 B
2 KB
216ms
216ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/project/info?fields=captcha
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
35200ef43ce26ee8103bd83e1224810c485ee94a7e74c5f3537344e6554f846e
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-25630ea31ca4ffe4c9fb40ff69a034d1-6449e3e35d85c037-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
9GuNzrj_-ks7tdm7PBxqoql-7rMtREZB2jTkz4fr

Response headers

x-request-id
13dc9cf3-5197-4571-bcf1-251b75a01e0d
content-encoding
br
cf-cache-status
DYNAMIC
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json; charset=utf-8
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
x-dns-prefetch-control
off
x-envoy-upstream-service-time
5
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecd51aacebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
info Show response
mafiacasino.com/ca/api/v3/project/
414 B
413 B
214ms
214ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/project/info?fields=cdnSettings
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
fd3c5e781df25f157c4f01d214c7befe4429f6840a172f1a7e49e61dfc37d952

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-2b3fcfce30a254887fca7b42e6705c00-451dde3de94ea0f9-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
E93h-g9z8MzX1-v1NPvNI3H5JNKg3Rq0DjMlBBGI

Response headers

content-encoding
br
cf-ray
a1eeecd51ab0ebb9-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json;charset=utf-8
vary
accept-encoding
server
cloudflare
priority
u=1,i
GET
H3
200
info Show response
mafiacasino.com/ca/api/v3/project/
456 B
2 KB
212ms
212ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/project/info?fields=registration
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
b23e66d4069b18ef616d8fad61aeaabba80fa8cd62e75d0b3d0d08758ac14e6d
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-8cb10db51e6711150c544e79c2e7e594-9ed01dff880c6176-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
dsVlOYiLNs9YxbTNS9ZsT3WNOOE8__eeEprV4RyM

Response headers

x-request-id
a461438e-1c8c-4a29-8058-acc454947429
content-encoding
br
cf-cache-status
DYNAMIC
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
application/json; charset=utf-8
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
x-dns-prefetch-control
off
x-envoy-upstream-service-time
13
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecd51ab8ebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H2
200
7cHpv4kjgoGqM7E_DMs5.woff2
fonts.gstatic.com/s/barlow/v13/
22 KB
22 KB
40ms
38ms
Font
font/woff2
172.253.115.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/barlow/v13/7cHpv4kjgoGqM7E_DMs5.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f94.1e100.net
Software
sffe /
Resource Hash
b0a8ad37ac45f5fb22ced461576db72e44e295107aad7a9c8a7a4bad728fd03b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

age
475598
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 16 Jul 2027 14:06:37 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 16 Jul 2026 14:06:37 GMT
last-modified
Wed, 10 Sep 2025 16:22:46 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
22196
x-xss-protection
0
server
sffe
GET
H2
200
7cHqv4kjgoGqM7E3t-4s51os.woff2
fonts.gstatic.com/s/barlow/v13/
22 KB
22 KB
50ms
48ms
Font
font/woff2
172.253.115.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/barlow/v13/7cHqv4kjgoGqM7E3t-4s51os.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f94.1e100.net
Software
sffe /
Resource Hash
2d797dd8b35dcb3413e1af9d7052b3f4f8c341a147cdcb01f4f06af80db53289
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

age
475595
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 16 Jul 2027 14:06:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 16 Jul 2026 14:06:40 GMT
last-modified
Wed, 10 Sep 2025 16:22:44 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
22788
x-xss-protection
0
server
sffe
GET
H2
200
7cHqv4kjgoGqM7E3j-ws51os.woff2
fonts.gstatic.com/s/barlow/v13/
22 KB
22 KB
62ms
60ms
Font
font/woff2
172.253.115.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/barlow/v13/7cHqv4kjgoGqM7E3j-ws51os.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f94.1e100.net
Software
sffe /
Resource Hash
6f5d995ccc4d8ffd9e8cb4c303fc1f3646d6c62d40269ef59463332f12d5b897
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

age
350629
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sun, 18 Jul 2027 00:49:26 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 18 Jul 2026 00:49:26 GMT
last-modified
Wed, 10 Sep 2025 16:22:48 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
22368
x-xss-protection
0
server
sffe
GET
H2
200
HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v13/
21 KB
21 KB
75ms
73ms
Font
font/woff2
172.253.115.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v13/HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f94.1e100.net
Software
sffe /
Resource Hash
460f141ec8f6c9a1516bfd2bd9fe71656246d7a9d04a0955faf53158d8970c4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

age
482965
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 16 Jul 2027 12:03:50 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 16 Jul 2026 12:03:50 GMT
last-modified
Mon, 08 Sep 2025 17:56:41 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
21424
x-xss-protection
0
server
sffe
GET
H2
200
HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v13/
22 KB
22 KB
86ms
84ms
Font
font/woff2
172.253.115.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v13/HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f94.1e100.net
Software
sffe /
Resource Hash
215a93c696f442034a46fbb382958f753fda60e30490683aeea6b235fcbb2b66
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

age
90631
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 21 Jul 2027 01:02:44 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 21 Jul 2026 01:02:44 GMT
last-modified
Mon, 08 Sep 2025 17:56:49 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
22308
x-xss-protection
0
server
sffe
GET
H2
200
HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v13/
22 KB
22 KB
95ms
94ms
Font
font/woff2
172.253.115.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v13/HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f94.1e100.net
Software
sffe /
Resource Hash
3787a5a419171630e6890cfa47c4da067474d005cd0ff8dc11ec090fdc3ee2b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

age
565196
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 15 Jul 2027 13:13:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 15 Jul 2026 13:13:19 GMT
last-modified
Mon, 08 Sep 2025 17:56:44 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
22444
x-xss-protection
0
server
sffe
GET
H2
200
HTxwL3I-JCGChYJ8VI-L6OO_au7B47b1z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v13/
22 KB
22 KB
105ms
104ms
Font
font/woff2
172.253.115.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v13/HTxwL3I-JCGChYJ8VI-L6OO_au7B47b1z3bWuQ.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f94.1e100.net
Software
sffe /
Resource Hash
2515494e8cc2ca07c86ea78766cfa104b796aa6ed5d66821c01d51dbb0b52bce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

age
350629
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sun, 18 Jul 2027 00:49:26 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 18 Jul 2026 00:49:26 GMT
last-modified
Mon, 08 Sep 2025 17:56:42 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
22464
x-xss-protection
0
server
sffe
GET
H2
200
HTxwL3I-JCGChYJ8VI-L6OO_au7B45L0z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v13/
21 KB
22 KB
112ms
111ms
Font
font/woff2
172.253.115.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v13/HTxwL3I-JCGChYJ8VI-L6OO_au7B45L0z3bWuQ.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f94.1e100.net
Software
sffe /
Resource Hash
aa01966de3f608a765a172237a3ffc6161fe4c7e3870b1a904dc6437e54c4e24
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

age
296964
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sun, 18 Jul 2027 15:43:51 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 18 Jul 2026 15:43:51 GMT
last-modified
Mon, 08 Sep 2025 17:56:43 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
21968
x-xss-protection
0
server
sffe
GET
H2
200
64c61ef7f252786cccd259fb80244d11.js Show response
cdn.cookie-script.com/s/
1 MB
221 KB
368ms
134ms
Script
application/javascript
188.166.63.236
DigitalOcean
General
Full URL
https://cdn.cookie-script.com/s/64c61ef7f252786cccd259fb80244d11.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/main.2bd32f7164550f10.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
188.166.63.236 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
nginx/1.26.3 /
Resource Hash
85d8fb5443796e173ef63b5dedd76e83d6d6c9ee1331f20f446f34938670c72e

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-cache-status
HIT
content-encoding
gzip
etag
W/"cf6af6981ef870f5635504f2bf9d7c4e"
access-control-allow-origin
*
date
Wed, 22 Jul 2026 02:13:15 GMT
last-modified
Tue, 10 Feb 2026 10:08:49 GMT
vary
Accept-Encoding
server
nginx/1.26.3
content-type
application/javascript
GET
H3
200
9002.59451feb5a9bbc54.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
23 KB
6 KB
99ms
99ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/9002.59451feb5a9bbc54.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
98ff19a40ff9102c81effad0207416315c5c7808fac5d7414ca1ba780cc131d1

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"e53d8602c29cdb0f779975e8a915e844"
age
9843
cf-ray
a1eeecd52af6ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:15 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
9133.cb5c3a0e9e0145dc.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
18 KB
5 KB
97ms
96ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/9133.cb5c3a0e9e0145dc.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
7f0dd5cf2e5b0c4d56b51666966cd33b59eb7e4ef8fe60647dfd0f53d0bf789c

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"208978273f1d2a2ce71340f1a938075d"
age
9754
cf-ray
a1eeecd52af9ebb9-YYZ
expires
Wed, 22 Jul 2026 03:30:41 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:15 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
9686.5b8d2c0f366eb1d9.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
14 KB
4 KB
96ms
96ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/9686.5b8d2c0f366eb1d9.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
05d98b25d591227495950a3fdcd56dd150cb6bafee355ed1d25fa27253f27ce3

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"d8efbba2c2bcbe48657a85217fa70c79"
age
9843
cf-ray
a1eeecd52afaebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:15 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
3032.af110614c7ad8c70.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
15 KB
5 KB
96ms
96ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/3032.af110614c7ad8c70.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
4da0b1082d27045b3fd511627ef8708b5c3bcce46e17cb4f55f08483142d1e3d

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"be2028939343ac190fe1446f3e8b3f89"
age
9843
cf-ray
a1eeecd53affebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
6215.8b0d075ca67b890d.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
15 KB
5 KB
99ms
99ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/6215.8b0d075ca67b890d.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
b21d5d110909d367da628482cb81e8faf99a9818df980cfaceaf3fa511b3af70

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"d261ba055a0a5a155ca8edfcae64aa82"
age
9843
cf-ray
a1eeecd53b00ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
7788.7b1c49545d4c54ab.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
16 KB
5 KB
99ms
98ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/7788.7b1c49545d4c54ab.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
783546fda73e86865d4848a76a2ad5678bb693ad767be36dc490ebc42d005cbf

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"9fe52fd3ac85a7c480f2c7c0bcaff6be"
age
9842
cf-ray
a1eeecd53b08ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
2924.ac010c5a36e0aa1b.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
111 KB
22 KB
130ms
130ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/2924.ac010c5a36e0aa1b.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
d0662790d9faeb32a860d9d8528b8dd809478ff31fcf48337184a766298c7ca1

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"e7ae9365c8ac7127d435c63e2b1b2944"
age
9842
cf-ray
a1eeecd53b0debb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
6455.c7650adcf9db94b8.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
34 KB
9 KB
130ms
130ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/6455.c7650adcf9db94b8.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
3ba52493e38d6662407c5aabcd7c982e92070e2a5eaa85348756bcb82b5aa6e6

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"be0bf7e46b8d7de2695305105d9f26f0"
age
9843
cf-ray
a1eeecd53b16ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
4350.9554fdd6b4665422.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
69 KB
11 KB
139ms
139ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/4350.9554fdd6b4665422.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
a72e4ed95aa5c261bc587d6f4f7a3dd5c2c13a88f071fbe0cb7282830365734c

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"b8ffd9525b502a1882298c7f23ff6239"
age
9843
cf-ray
a1eeecd53b1debb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
2622.4e7c6b5ed5a9cb53.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
26 KB
7 KB
183ms
182ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/2622.4e7c6b5ed5a9cb53.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
6a1e6df2926c23830dccb587abf97e0a22f0e03ca25ab74b4ce925839ede585e

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"1411f98b6cd660a9e2da3f7df1f95225"
age
9843
cf-ray
a1eeecd53b1eebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
202.ebeb2afeee7c008f.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
79 KB
17 KB
188ms
188ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/202.ebeb2afeee7c008f.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
babab4af8cd2e6d6d813e03132cba7701e833669f638c1720d5524f98d127460

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"8689501c4c7762b7a47a3a59fc3f4647"
age
9843
cf-ray
a1eeecd53b24ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:12 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:11 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
POST
H3
200
browser-logs Show response
mafiacasino.com/
15 B
195 B
321ms
288ms
Fetch
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/browser-logs
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

sec-ch-ua-platform
"Linux"
Authorization
Bearer cxtp_vbQJjf7Tyfdg5zj7Qo16RbLtHt6DlF
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
grpc-status,grpc-message
cf-cache-status
DYNAMIC
cf-ray
a1eeecd69f31ebb9-YYZ
access-control-allow-origin
https://mafiacasino.com
alt-svc
h3=":443"; ma=86400
content-length
15
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
application/json
vary
accept-encoding
server
cloudflare
priority
u=1,i
GET
H3
200
t.js Show response
mafiacasino.com/cdn/edge/dd/
115 KB
41 KB
76ms
75ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cdn/edge/dd/t.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/main.2bd32f7164550f10.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
b5d79b19776f7c1dfca14d87cba9372208a33d9c286a23355ac0f038f73aaff5
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"552f4da284a00985dcc3e4ecd57660d5"
age
58336
x-amz-version-id
fzNiDAXHepIWqgNwOXoRlrm1hI9LdhTH
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
1b281YK4rJKHOieZbj97uYrh1tuRmN52lnZrrAXDLs2q4WoT8LC_TA==
date
Wed, 22 Jul 2026 02:13:15 GMT
content-type
text/javascript
last-modified
Mon, 20 Jul 2026 09:33:41 GMT
vary
Accept-Encoding, Origin
priority
u=3,i=?0
server-timing
cfExtPri
strict-transport-security
max-age=15768000
cache-control
max-age=3600, public
via
1.1 c967b84deb6944b2848e7f825db5e926.cloudfront.net (CloudFront)
cf-ray
a1eeecd6cfafebb9-YYZ
x-amz-cf-pop
YUL62-P4
server
cloudflare
x-amz-server-side-encryption
AES256
GET
H3
200
api.js Show response
challenges.cloudflare.com/turnstile/v0/b/3104729c556c/
Redirect Chain
  • https://challenges.cloudflare.com/turnstile/v0/api.js
  • https://challenges.cloudflare.com/turnstile/v0/b/3104729c556c/api.js
73 KB
24 KB
44ms
43ms
Script
application/javascript
104.18.95.41
Cloudflare
General
Full URL
https://challenges.cloudflare.com/turnstile/v0/b/3104729c556c/api.js
Protocol
H3
Server
104.18.95.41 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c5c445b67e1cb710a98338a2ee3631506a50351a355c9cbcf455c8fc48a21f6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://mafiacasino.com/

Response headers

cache-control
max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
content-encoding
br
etag
W/"6a52e195.00000000-12529"
cross-origin-resource-policy
cross-origin
cf-ray
a1eeecd7aeaddf5a-YYZ
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Sun, 12 Jul 2026 00:36:37 GMT
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
location
/turnstile/v0/b/3104729c556c/api.js
cross-origin-resource-policy
cross-origin
cf-ray
a1eeecd72d2fdf5a-YYZ
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
server
cloudflare
priority
u=3,i=?0
GET
H3
200
favicon.svg
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
5 KB
2 KB
59ms
58ms
Other
image/svg+xml
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/favicon.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
92ae7c416ebb796f7c50f9218b240df3aaefd79f652ec2bcbd81b4aa7b261e17

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"890f740d8499a20a0f5d0212be074f01"
age
8806
cf-ray
a1eeecd7aa66ebb9-YYZ
expires
Wed, 22 Jul 2026 03:46:29 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
image/svg+xml
last-modified
Fri, 17 Jul 2026 13:48:39 GMT
server
cloudflare
priority
u=1,i
vary
accept-encoding
GET
H3
200
2127.3b94731d52fee4c7.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
14 KB
4 KB
51ms
51ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/2127.3b94731d52fee4c7.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
1d5ff1771c2cabbc3332aa44e62bacd7bc292a1e22e5e73111ac29d0c9281427

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"59c90798b8a98292233186199c83300e"
age
9841
cf-ray
a1eeecd86c88ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
1852.7158a2a497d987c1.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
3 KB
2 KB
99ms
99ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/1852.7158a2a497d987c1.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
d8c73dabf8061fb453287eddb84bc1dcd34d3db41c50938f232231bf9a9ae191

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"c6ee2f2154c9b2984fdfb4f184c23661"
age
9841
cf-ray
a1eeecd86c8aebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:11 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
405.44a15f6816ff4c2a.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
106 KB
33 KB
51ms
50ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/405.44a15f6816ff4c2a.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
4037f4299bda5be7a68f138f5f18fc810bd3fdd6856b1ded6689e9d2c2dd756c

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"e406e8e36e4146f49c7ee7b505476edc"
age
9841
cf-ray
a1eeecd86c8cebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
8309.a3118e4a2df3e4f0.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
24 KB
7 KB
53ms
53ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/8309.a3118e4a2df3e4f0.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
f57c222d9765c4e31a08e4b06b62bb7275945afcd799c8c441c7fe6a21efee88

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"02eff37437d0f9c19e77dce1aa3ca4ad"
age
9841
cf-ray
a1eeecd86c8eebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
9230.6ba4e7b537c4a1fe.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
260 KB
74 KB
53ms
53ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/9230.6ba4e7b537c4a1fe.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
e677926a3508b947ed8a76bedca3df32f6e4ca4882371c4571af6201b986c418

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"078e44f19eeeef3a0117ec31c4b156ce"
age
9841
cf-ray
a1eeecd86c91ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:15 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
3446.f8c63086464ad04b.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
46 KB
12 KB
82ms
81ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/3446.f8c63086464ad04b.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
1d2a05342ccb88ab243f8e6aab5e393b7c390d1c99a52aafce4d7c8bde4de25a

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"625924a63624d82644fa26db23eed1f1"
age
9841
cf-ray
a1eeecd86c93ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
7615.158d198dcfbe8b2f.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
86 KB
19 KB
82ms
81ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/7615.158d198dcfbe8b2f.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
fa3c57ad94c6f5ce1eac453fff8ec1ae3fb8094ff9f0259b1291e07b09b58aef

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"14fb083a4c662b6ab22c32b1b9217bd8"
age
9841
cf-ray
a1eeecd86c96ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
2082.2c56104c8f2a9607.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
1 KB
949 B
48ms
48ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/2082.2c56104c8f2a9607.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
e468fdf96d4f486bb4831e232c8c7acdcaa2005c35b0c23e26bcdac2c9bd6623

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"c0941646c6021b9bf1bf06564cc17051"
age
9841
cf-ray
a1eeecd86c99ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:11 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
POST
H3
200
browser-logs Show response
mafiacasino.com/
15 B
195 B
331ms
294ms
Fetch
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/browser-logs
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

sec-ch-ua-platform
"Linux"
Authorization
Bearer cxtp_vbQJjf7Tyfdg5zj7Qo16RbLtHt6DlF
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
grpc-status,grpc-message
cf-cache-status
DYNAMIC
cf-ray
a1eeecd89d1debb9-YYZ
access-control-allow-origin
https://mafiacasino.com
alt-svc
h3=":443"; ma=86400
content-length
15
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
application/json
vary
accept-encoding
server
cloudflare
priority
u=1,i
GET
H3
200
favicon.ico
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
9 KB
2 KB
64ms
64ms
Other
image/vnd.microsoft.icon
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
d0594a9e7f8f4a4cb964e91fc2692820319bbc2b5c05b00f61fc6f28619703aa

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"310dcf96f5760a471f10d0e6586b6e59"
age
8805
cf-ray
a1eeecd91e87ebb9-YYZ
expires
Wed, 22 Jul 2026 03:46:30 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
image/vnd.microsoft.icon
last-modified
Fri, 17 Jul 2026 13:48:39 GMT
server
cloudflare
priority
u=1,i
vary
accept-encoding
GET
H2
200
js Show response
www.googletagmanager.com/gtag/
477 KB
163 KB
74ms
73ms
Script
application/javascript
142.251.163.97
Google LLC
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-81P3YM2SHW&cx=c&gtm=4e67k1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K6B6C44T
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.97 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
wv-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
e4e656b0f6c4b2bde0d8035cb24d46cee8cf18dcb457895be96e6120d119a662
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
content-encoding
zstd
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
expires
Wed, 22 Jul 2026 02:13:16 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
166369
date
Wed, 22 Jul 2026 02:13:16 GMT
x-xss-protection
0
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
Google Tag Manager
access-control-allow-headers
Cache-Control
GET
H2
200
hotjar-6463121.js Show response
static.hotjar.com/c/
15 KB
6 KB
138ms
51ms
Script
application/javascript
18.160.41.58
Amazon.com
General
Full URL
https://static.hotjar.com/c/hotjar-6463121.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K6B6C44T
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.160.41.58 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-160-41-58.iad55.r.cloudfront.net
Software
/
Resource Hash
52efcec1516195a656f9887e5942a67576916af3ed1cfa0d3a660b78fef073f2
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
W/ff77f6961a61d9bded1b5445df56c50b
age
42
x-content-type-options
nosniff
x-cache-hit
1
x-cache
Hit from cloudfront
x-amz-cf-id
46bQ1TAa-th7LD9mICuBYP8pvgYi24R6horJP_KN8XEyHjVF8CvfGQ==
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
max-age=60
cross-origin-resource-policy
cross-origin
via
1.1 3d3fd40be4e4bfdd1e1bebf86df63a76.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
IAD55-P1
GET
H2
200
ld.js Show response
dynamic.criteo.com/js/ld/
73 KB
25 KB
124ms
42ms
Script
application/javascript
74.119.117.6
Criteo Corp.
General
Full URL
https://dynamic.criteo.com/js/ld/ld.js?a=125125&a=125126&a=125127&a=125128&a=125129&a=125130
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K6B6C44T
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.6 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
2e1855d1eb4e8c77c9334507c0fa2036b3951912cb239220384f4cae3c4af4f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
public,max-age=10800
timing-allow-origin
*
content-encoding
br
x-criteo-endpoint-version
none
cross-origin-resource-policy
cross-origin
x-criteo-endpoint-action
Get
x-criteo-endpoint-controller
Ld
access-control-allow-origin
*
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
application/javascript; charset=utf-8
vary
Origin, Accept-Encoding
server
Kestrel
GET
H2
200
tag-manager.js Show response
tm.ads.sportradar.com/dist/
326 KB
33 KB
757ms
627ms
Script
application/javascript
23.48.203.44
AKAMAI-ASN1 Akama...
General
Full URL
https://tm.ads.sportradar.com/dist/tag-manager.js?id=STM-AAABBF
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.48.203.44 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-48-203-44.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
18d4940b792d3290173047ab564b5d70c58f24b6e9e194aee7be1bb109bb02d5

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=900, public
content-encoding
gzip
apigw-requestid
A4sRlg8BDoEEJYw=
content-length
33776
x-amz-cf-id
LDveh4afuzhiXWIVDD3WZsQicl4d0Xjs5KXCHpo_ffToJG8PusvauQ==
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
application/javascript
content-disposition
inline
vary
Accept-Encoding
x-amz-cf-pop
MCI50-P1
GET
H2
200
tc.min.js Show response
c1.rfihub.net/js/
19 KB
7 KB
119ms
35ms
Script
application/x-javascript
18.239.6.77
Amazon.com
General
Full URL
https://c1.rfihub.net/js/tc.min.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.239.6.77 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-239-6-77.yul62.r.cloudfront.net
Software
Jetty(9.4.51.v20230217) /
Resource Hash
1012e66fe3edac52a719e8999620861139c2059df08c6a7a2593a90873a7ad2d

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-amz-cf-id
kxMk1n6B9YBDwE93Z-tMe0EP8cssXjnREDTZZgxpyMx_s6rxBKAcfQ==
cache-control
public, max-age=3600
content-encoding
gzip
age
3226
via
1.1 76f1b1079264cbea8779bd0ad6ab034a.cloudfront.net (CloudFront)
expires
Wed, 22 Jul 2026 02:19:30 GMT
x-cache
Hit from cloudfront
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
6276
date
Wed, 22 Jul 2026 01:19:30 GMT
content-type
application/x-javascript
last-modified
Wed, 22 Jul 2026 01:19:20 GMT
server
Jetty(9.4.51.v20230217)
x-amz-cf-pop
YUL62-P3
GET
H2
200
trackpoint-async.js Show response
s2.adform.net/banners/scripts/st/
81 KB
32 KB
122ms
39ms
Script
application/javascript
185.167.164.45
ADFORM Adform A/S
General
Full URL
https://s2.adform.net/banners/scripts/st/trackpoint-async.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.167.164.45 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
59938868870ce60b8576506d0211346d8a85329a9d54997c39d921389c493b34

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-cache-status
HIT, HIT, HIT
cache-control
public, max-age=604800
content-encoding
gzip
etag
W/"cbd67ec72136561be113efd03055f4f4"
x-amz-request-id
tx0000042a172c46066c398-006a0f12ea-32cad494-default
access-control-allow-origin
*
date
Wed, 22 Jul 2026 02:13:16 GMT
x-rgw-object-type
Normal
content-type
application/javascript
vary
Accept-Encoding
server
nginx
last-modified
Wed, 25 Jun 2025 09:36:45 GMT
GET
H2
200
/ Show response
track.adform.net/Serving/Cookie/
73 B
648 B
484ms
119ms
Script
text/javascript
37.157.2.230
ADFORM Adform A/S
General
Full URL
https://track.adform.net/Serving/Cookie/?adfaction=getjs;adfcookname=uid
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K6B6C44T
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
37.157.2.230 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
5d9e8cfd13ab9f3cb184ee716c93c4c007837b001ab17f762269a64b2d8958cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
content-encoding
gzip
access-control-allow-methods
GET,POST
expires
-1
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript; charset=utf-8
vary
*
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-origin
*
server
nginx
GET

blue-tag.min.js
event.getblue.io/js/
0
0


GET
H3
200
flux_mafiacasino.js Show response
scripts.rubiconredirect.com/scripts/
2 KB
2 KB
83ms
57ms
Script
text/javascript
104.21.19.114
Cloudflare
General
Full URL
https://scripts.rubiconredirect.com/scripts/flux_mafiacasino.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.19.114 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7234b6a4fc50d44b4a457e296d017041ddeae609f1c8a05261a8a1686428a205
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-request-id
f85f76b4-38ec-4303-83d6-73d93d95dfcb
content-encoding
zstd
cf-cache-status
DYNAMIC
etag
W/"7234b6a4fc50d44b4a457e296d017041"
x-permitted-cross-domain-policies
none
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=lwni1csE3yVWgWhzz9tbe74iXetXjfFZaZV3tdN3b8yzBHwQGgCGPo8agN1NEMjOtg1tigVvJ%2BOJVjsXbcd2WE%2Byq5xYi39lUy%2BxNvc7IAcRiP3udWr6Dh1owuyzoxb7%2FSDnz7n38u0oOHXoino%3D"}]}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript; charset=utf-8
x-runtime
0.006298
priority
u=3,i=?0
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=63072000; includeSubDomains
cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
a1eeecd94a92a2d9-YYZ
access-control-allow-origin
*
x-xss-protection
0
server
cloudflare
GET
H2
200
casino_mafia.js Show response
safe-track.pro/
612 B
507 B
592ms
190ms
Script
text/javascript
198.54.115.232
Namecheap
General
Full URL
https://safe-track.pro/casino_mafia.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K6B6C44T
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.115.232 , United States, ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US),
Reverse DNS
server223-3.web-hosting.com
Software
LiteSpeed /
Resource Hash
78a334f23967c38d03a96335cde0420f71ff3001f504de93214e4909ccd66f44

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
accept-ranges
bytes
content-length
334
date
Wed, 22 Jul 2026 02:13:16 GMT
x-turbo-charged-by
LiteSpeed
content-type
text/javascript
last-modified
Fri, 12 Jun 2026 16:09:13 GMT
vary
Accept-Encoding
server
LiteSpeed
GET
H2
200
853e630b-7404-44f8-a608-90d9cadf6127.js Show response
cdn.iconvert.network/code/
797 B
1 KB
109ms
33ms
Script
application/javascript
13.225.196.71
Amazon.com
General
Full URL
https://cdn.iconvert.network/code/853e630b-7404-44f8-a608-90d9cadf6127.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K6B6C44T
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.196.71 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-225-196-71.yul62.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
272bafc1206bce355050e8b8289f1dbd9b031974bc18de4d16b991309a827821

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-amz-version-id
YMGaGMa37Zzv5aHxfnRHlx_eBNw5DKoK
etag
"58655fe7da5746f5a24cf2c72ba58bed"
age
9651
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
tfgZ5Y59gdrW-MezrH3gTyDf2giB9AAT6yH5NoDD-lER8O_4iwf4MQ==
date
Tue, 21 Jul 2026 23:32:26 GMT
content-type
application/javascript
vary
Accept-Encoding, Origin
last-modified
Mon, 06 Jul 2026 09:20:10 GMT
cache-control
max-age=10800
via
1.1 f3f1b52cd1e66015fa35acf7e56ff492.cloudfront.net (CloudFront)
accept-ranges
bytes
content-length
797
x-amz-cf-pop
YUL62-P4
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H2
200
associate-segment
segment.prod.bidr.io/
Redirect Chain
  • https://segment.prod.bidr.io/associate-segment?buzz_key=dsp&segment_key=dsp-37338&value=
  • https://segment.prod.bidr.io/associate-segment?buzz_key=dsp&segment_key=dsp-37338&value=&_bee_ppp=1
43 B
574 B
53ms
51ms
Image
image/gif
44.208.106.13
Amazon.com
General
Full URL
https://segment.prod.bidr.io/associate-segment?buzz_key=dsp&segment_key=dsp-37338&value=&_bee_ppp=1
Protocol
H2
Server
44.208.106.13 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-44-208-106-13.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://mafiacasino.com/

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
cache-control
no-cache, must-revalidate
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
content-length
43
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
image/gif
server
gunicorn

Redirect headers

strict-transport-security
max-age=2592000; includeSubDomains
location
https://segment.prod.bidr.io/associate-segment?buzz_key=dsp&segment_key=dsp-37338&value=&_bee_ppp=1
content-length
0
date
Wed, 22 Jul 2026 02:13:16 GMT
server
gunicorn
GET
H3
404
item Show response
mafiacasino.com/ca/api/v3/seo/
75 B
1 KB
198ms
198ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/seo/item?page=login
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
8544fd687b99eb9e3f1104f315dfe557b49bb3440e1ad50f9afe6adada2032b9
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-4cc71f0403fbdde9866e5d7331b457cd-d76f36d57bf6643a-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
a28nKStcxnL8lMrX2xm--hJtvuvY1wF11d6yyAxT

Response headers

x-request-id
12c8dbe3-c917-4461-88eb-95a96e0336a0
content-encoding
br
cf-cache-status
DYNAMIC
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
application/json; charset=utf-8
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
x-dns-prefetch-control
off
x-envoy-upstream-service-time
16
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecd99868ebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
3188.6e7dde4460299999.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
10 KB
4 KB
60ms
60ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/3188.6e7dde4460299999.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
d62dda9559c8add641c3ae9fa2852e272a6ab5f54e930c0f0eff5e46402b077a

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"34ea0fc486643045661fd9614b2a8404"
age
9841
cf-ray
a1eeecd9986cebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
8668.2d722134283d44cb.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
34 KB
9 KB
62ms
61ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/8668.2d722134283d44cb.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
66f48e1eb1bc300b737ada04d243733c151e15fdda33f30e34b4fab002e72bed

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"e530a134e3b7c17384ccfdd6b235b46e"
age
9841
cf-ray
a1eeecd9986eebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:15 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
830.5a12ffc4f001eb6f.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
13 KB
4 KB
97ms
96ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/830.5a12ffc4f001eb6f.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
6ee1ee2d4ba92b18886f948724bd0c018ec2fb4881bc50f85217487747047ce5

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"73abbeead770aba6c57b9df747eeeba7"
age
9841
cf-ray
a1eeecd99873ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
2166.052b718fac22de64.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
11 KB
4 KB
101ms
101ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/2166.052b718fac22de64.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
20558b95c6baf40f42e0516d5d49c5f895485ad21109aefa76b0092f48311756

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"52aabbb2c6f0c25791c20ca77ccff7d6"
age
9841
cf-ray
a1eeecd9987cebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
8207.96b7e62dfc682d44.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
13 KB
4 KB
101ms
100ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/8207.96b7e62dfc682d44.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
05ab7bc8114481df9930bf64daaf231dbc17be338bed89298ed6a2b888fe98fb

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"b2f7dff40ce48472fccc16e8d3245517"
age
9841
cf-ray
a1eeecd9a883ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
6879.ef38a0f6e7004e70.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
1 KB
840 B
101ms
100ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/6879.ef38a0f6e7004e70.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
3663d58af24be6aa25d0476aa089d190be6aa0de6c360431fb9ddd63d573f0a2

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"ccc3b51d2636dcf952602a1ec5a85b15"
age
9841
cf-ray
a1eeecd9a886ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
9089.d24020dfc0f70abc.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
15 KB
4 KB
107ms
104ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/9089.d24020dfc0f70abc.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
3932e3ba6d0d63461a546aa76034e374014f4148120b8d8dab55c3ca80602871

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"ff33b84bb46166a0c44c83e0c16aa62b"
age
9841
cf-ray
a1eeecd9a88cebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:15 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
2553.03ef5536ead08c85.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
23 KB
6 KB
111ms
109ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/2553.03ef5536ead08c85.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
13cb887840d71fce7756287c3bf9c30461371165e824f41070552079fe7a019b

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"fbb808273b25152d68e73069fb12a338"
age
9841
cf-ray
a1eeecd9a891ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
2995.520ba6f0a67b27d7.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
50 KB
11 KB
106ms
104ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/2995.520ba6f0a67b27d7.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
f8adb1845d2f8a3121bf5fd9bca711bcfe5d13374b4e4b19d4e694bfb1604240

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"47a171f1d9116840596b793c3f45de55"
age
9841
cf-ray
a1eeecd9a897ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
392.9270bc2cac6a23ae.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
37 KB
9 KB
97ms
95ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/392.9270bc2cac6a23ae.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
7e83e939730459875a6b87231062c40e96889d2715c0427ec1bd3a341b1cd74e

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"2573efda8cbe7b05db71288fbe79b9a0"
age
9841
cf-ray
a1eeecd9a899ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
129.b205581bf3415fd0.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
42 KB
10 KB
128ms
126ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/129.b205581bf3415fd0.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
cecc334b018bf8f81b484b503088a903e26dfa83f4a0bb20ae57f06ea718d18e

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"0908bf5e0fd0e85271467fe8f61ef710"
age
9841
cf-ray
a1eeecd9a89cebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:11 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
351.758f68da835dcf92.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
15 KB
5 KB
97ms
94ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/351.758f68da835dcf92.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
47135c097ef78fb93c3988aab703004596401225226ef9a33ac93c0a2432bf09

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"f528e7b2c1084ed873a1177934814025"
age
9841
cf-ray
a1eeecd9a8a3ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
6728.a12ba45b2c52d2b4.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
13 KB
4 KB
92ms
91ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/6728.a12ba45b2c52d2b4.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
9206470d3680b8ba127cc6ea121f9d89362c85f12fb6197889fe62ec99a953ee

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"dc948eae508b58582bb81d61e159d36a"
age
9841
cf-ray
a1eeecd9a8a8ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
8380.ecc23ed0e05c2f39.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
25 KB
6 KB
125ms
124ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/8380.ecc23ed0e05c2f39.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
c4ba703ca952cd992cc9a4e833020bab9ddd3b627e0af264ca0c86f1dddd6938

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"c1cd1bdf4698be91a03a9baf8c64b4a5"
age
9841
cf-ray
a1eeecd9a8acebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
7153.ed362fddd2c8823a.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
13 KB
4 KB
132ms
130ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/7153.ed362fddd2c8823a.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
d7d635822b264fd3459bb6a7179593be0e56b23f115e79ccbe3923e168186901

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"2e01d51ed0d654212df1fc58884fa24f"
age
9841
cf-ray
a1eeecd9a8b0ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
4126.a5f6bf01c4e8f053.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
40 KB
11 KB
131ms
129ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/4126.a5f6bf01c4e8f053.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
8d897f4bddeb5b73472b17d287efd255a745c5117b0c36a16c6d7036911a6e9a

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"a42ceaeaa3de00ab90845008ab9e797c"
age
9841
cf-ray
a1eeecd9a8b7ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
3126.71508955d6e4d8a0.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
5 KB
2 KB
133ms
131ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/3126.71508955d6e4d8a0.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
cf2ba67b465dfc2147433138a40ddcffe330c6cfb8f49bdb49669b38605a6af7

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"a974fa39c77df5a0513358fada123103"
age
9841
cf-ray
a1eeecd9b8beebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
7740.025ed2368710f9e1.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
165 KB
35 KB
89ms
87ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/7740.025ed2368710f9e1.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
fb49e916c1ab7e8b473309bb7acce514e992e807c1fa0ad4187963adae690d5f

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"0c204c581707f05262b716150ed14e64"
age
9841
cf-ray
a1eeecd9c8dbebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
7408.c44c934c1c334940.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
17 KB
6 KB
132ms
130ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/7408.c44c934c1c334940.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
dfdcc690dbe70f99a2f452eb04f8a31bc34d6872cf14059854ff8e4f876d86ad

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"5e546fb0a9241fc2da9222868ba81c77"
age
13727
cf-ray
a1eeecd9c8deebb9-YYZ
expires
Wed, 22 Jul 2026 02:24:29 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
738.01f8f2bfb5dd2c4f.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
24 KB
7 KB
93ms
91ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/738.01f8f2bfb5dd2c4f.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
bcd8761987e21cf2ccf4d91ad22c5c64c675e2d4976ec05281ab142348af1f39

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"a649cf9363d29c2373ce0ccf408e4661"
age
9841
cf-ray
a1eeecd9c8e1ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
7076.79a2d874f0fb497f.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
40 KB
9 KB
93ms
91ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/7076.79a2d874f0fb497f.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
9a8192ce9cd6f8d16c2067c497993055b98be0254f2c92130be08d832f00c330

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"af6a31e8727d0be4056eb8df8b12d35b"
age
9841
cf-ray
a1eeecd9c8e3ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
6104.96fe1941c45bb0a6.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
46 KB
10 KB
93ms
91ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/6104.96fe1941c45bb0a6.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
0241583fe0a81ffb1201b4bd1b5bba5a0088480adefd0568fedde6c38f3220e3

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"d1528f8cd0658abd7b9b9d4017fa97b9"
age
9841
cf-ray
a1eeecd9c8eaebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
4598.9b582f557d70eb32.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
15 KB
4 KB
97ms
96ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/4598.9b582f557d70eb32.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
3a6723868cf05bf520ff3b8913f1bf214b1ed20f95e34e21b8bc9586b99ea8f7

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"1cd24b79d5cd2a47e946a31f45f60b0e"
age
9841
cf-ray
a1eeecd9c8f0ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
4432.4d4239cfc7bcd082.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
30 KB
7 KB
92ms
91ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/4432.4d4239cfc7bcd082.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
6ae4b6dcd481ec6811e88ca843dda54177ca87c90ffa789bb9dd922bb1494109

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"5b2f552762be78a844ba3622a721085a"
age
9842
cf-ray
a1eeecd9c8f1ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:13 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
2108.23500b41b98d2be3.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
35 KB
10 KB
95ms
94ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/2108.23500b41b98d2be3.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
d3b456fbbc69a430a8163b6e37c73def04571e40264646bddce444f04e6cf1fb

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"3c645a3afe833ca06a7f9fc81cdd4edb"
age
5002
cf-ray
a1eeecd9c8f4ebb9-YYZ
expires
Wed, 22 Jul 2026 04:49:54 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:11 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
462.2faf887c9903fef1.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
16 KB
6 KB
124ms
124ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/462.2faf887c9903fef1.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
b9de52c7b623e9b7ad24ed35df2b243d290eb6df336fba90ed990c5bac8e16d9

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"bed19f59dd4f3933a550a9357b47dedc"
age
9841
cf-ray
a1eeecd9c8faebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
2129.e7c9316a08684b4a.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
2 KB
1 KB
124ms
123ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/2129.e7c9316a08684b4a.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
f913ced1f2a6a1103c58417e729e568ec42e8e01ac9f6873053b2a26a34737f3

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"12d2282aa06676ad97acde4dcb4ff107"
age
9841
cf-ray
a1eeecd9c902ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:11 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
1495.87a736f994eaf00a.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
2 KB
1 KB
93ms
90ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/1495.87a736f994eaf00a.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
16112ed7fd2f9600b662a0b87426711872fed4022a604a68da70cb87258aa27b

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"a4fc748211e8f606f5d3cc88e03de455"
age
9841
cf-ray
a1eeecd9c904ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:11 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
9682.2e259a161aeb265c.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
5 KB
2 KB
122ms
120ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/9682.2e259a161aeb265c.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
712ce9adf207f90032a74e04f2ffc8dbb9ba3a1be016e8a4a08a2da59ce4a34d

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"6e33f83fb46a75aba747a6162bef904f"
age
9841
cf-ray
a1eeecd9c907ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:15 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
1352.5a869e42f665c66a.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
16 KB
4 KB
126ms
124ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/1352.5a869e42f665c66a.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
4ff3166c3b5b941a47c6de204946b659e38310e64f22bb46cfa40cb451ce5b00

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"6c7caca15650887dc7f9f1d54343b8bb"
age
9841
cf-ray
a1eeecd9c90cebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:11 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
4557.5d642fd119275071.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
28 KB
6 KB
126ms
124ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/4557.5d642fd119275071.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
7d8ab42bffa2b5e2e847eeb271185006847dcadb34cd1b6843443f8f14d61b2f

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"9183892363d92498344259aee6608adb"
age
9841
cf-ray
a1eeecd9c911ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
5293.84e338f8b99ed13a.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
3 KB
1 KB
125ms
124ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/5293.84e338f8b99ed13a.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
72f4c78c3eade56494d1599f29110a718938c8fecf3b3093170ad3490fe74aa6

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"d72b263a10af042a0c92478f9a0c51a9"
age
9841
cf-ray
a1eeecd9c916ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
7266.349536156071cf6e.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
2 KB
1 KB
125ms
124ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/7266.349536156071cf6e.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
b2e7c251a01c676b992acb20133ef377bd55aa22e56450abf78486c823ee403c

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"1e8d12aa585ae0a87af98bef51d7aacd"
age
9841
cf-ray
a1eeecd9c918ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
8407.e8a05df9d37092fe.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
2 KB
1 KB
125ms
125ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/8407.e8a05df9d37092fe.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
037bacd626e93f7b7380ee9e41aa365ccc52283dc9e62de7152f678831720a64

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"f382ed03fe0b319d7633aebc1b74d1f5"
age
9841
cf-ray
a1eeecd9c91aebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
6055.46f6c3df3d6fe8dd.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
1 KB
983 B
120ms
120ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/6055.46f6c3df3d6fe8dd.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
ba0b3454d097bda80fdec5c9b264bb4f34a9cbd9dc5d6c00d54230b7bb73143c

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"8f4130046b3b389e05cf86c9d09b3fd1"
age
9841
cf-ray
a1eeecd9c91eebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
7652.a0d38df1f24b82e2.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
5 KB
2 KB
119ms
118ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/7652.a0d38df1f24b82e2.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
886164eda6172a0c7895cb70324e60124b941b96e9e935ee61fa497a8bc0d9f5

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"4ebc8af8ad6751c4bfa83e371b6621fd"
age
9841
cf-ray
a1eeecd9c922ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
1712.5e0840888bddeaff.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
162 KB
39 KB
119ms
118ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/1712.5e0840888bddeaff.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
b15a96b60dc8023156615199897a531847b0ad4a3982ae4c6d51be2189215d17

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"20babc4d0c3322d44e10f43a24391c5b"
age
9841
cf-ray
a1eeecd9c928ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:11 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
7911.a4e869d0503f9441.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
9 KB
3 KB
127ms
125ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/7911.a4e869d0503f9441.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
43c04904bc016a888a3597c171ee033c10ebf398a8d499d239f7565ac689432a

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"e6a7bfd1bb49d135cda7bdf8ffcd8914"
age
9841
cf-ray
a1eeecd9c92cebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
9026.ae2f628335e40be8.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
33 KB
8 KB
123ms
122ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/9026.ae2f628335e40be8.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
2f63d4b6a21cb85222673d043c0c4a644eca379e40f808af4cd2a53cc16da0f1

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"b51ffc9b0cb12416531eda2135a65b24"
age
9841
cf-ray
a1eeecd9c930ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:15 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
1291.1476465b9a831f9a.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
2 KB
1 KB
124ms
123ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/1291.1476465b9a831f9a.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
673f2535bc8ab34817604b9df7d471f020ed2a198bde1a4754bb044f8a530f0f

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"29cb4eb47330ef13bb4242a01e17e22a"
age
9841
cf-ray
a1eeecd9c933ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:11 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
8357.67ee7414024271d4.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
43 KB
11 KB
124ms
123ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/8357.67ee7414024271d4.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
e15f91305495a6b6ce8cb22e5f829e9f85189cf6e797686dd8b3a17f1b6a7409

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"135ae612cf57e5d015fe4c3d59c6da43"
age
9841
cf-ray
a1eeecd9c936ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
7051.4739fd79c36e6fc4.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
4 KB
2 KB
128ms
127ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/7051.4739fd79c36e6fc4.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
d64f9c4b2b02a9bbad5c0189d6bd998983685d7b1043166807b936f30c701e6a

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"d1ce203d97d86444167a1b90b818090b"
age
9841
cf-ray
a1eeecd9c93cebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
5233.6416fc47ce8a0716.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
9 KB
3 KB
124ms
123ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/5233.6416fc47ce8a0716.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
ce7e0cb4bcf9bcb2ff9192615a7f5464dba839d94e69c2b431a373152bf0e8e3

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"08158b6e2079c1f72a54c3a2d84c71ef"
age
9841
cf-ray
a1eeecd9c940ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
6976.9e6a42b0a3c833c3.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
11 KB
3 KB
124ms
123ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/6976.9e6a42b0a3c833c3.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
588f6ae9581dc35afdcf5b69b85071f8e25f45ce63ce7c8810fed3de486508db

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"c67703b37394f31cb10ecb0f6e184c89"
age
9841
cf-ray
a1eeecd9c944ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
277.aef7e4e60ab68f5f.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
6 KB
2 KB
124ms
124ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/277.aef7e4e60ab68f5f.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
a8c000eddd9ddf22529f49d73f09f6dc1bb438017730d2c9a39aa9ce83d1e1d2

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"51df95dcfa62e3e1477eb1a5fb8fa285"
age
9841
cf-ray
a1eeecd9c948ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
8291.c239e4f2fc2d71fc.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
120 KB
21 KB
124ms
123ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/8291.c239e4f2fc2d71fc.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
02556635753e610f8018141368fee00c43d46f890eae7c9d07a217bb25713ade

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"86846e563c508d6c6dcb4e2891e07589"
age
13727
cf-ray
a1eeecd9c94bebb9-YYZ
expires
Wed, 22 Jul 2026 02:24:29 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
8834.5f0b8c40b4372246.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
12 KB
4 KB
130ms
130ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/8834.5f0b8c40b4372246.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
da8456f776cc1aea7ff4f1e85f98a9a8b176afa8eddfe481e6b2a35081a79599

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"50b945f0acd99d4f57efcc283e375832"
age
9841
cf-ray
a1eeecd9c94debb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:15 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
5670.c0f5efe79847f16e.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
20 KB
6 KB
130ms
129ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/5670.c0f5efe79847f16e.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
28ea305fc2a4110819b9eebf8cd9c558dbdc013ef205f6d3c653ecf89ee3e1a8

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"d8fc293790a49dbb310c7d9689ed2109"
age
9841
cf-ray
a1eeecd9c953ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
8197.bf86873577a0ae92.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
130 KB
29 KB
136ms
135ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/8197.bf86873577a0ae92.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
572409c309c86fc1ff9a5806ce5e9034e232d49bb15f41ed931e7d0e9f28bed6

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"09bc29c1eaf4ce627f45edf2802f13b2"
age
9841
cf-ray
a1eeecd9c959ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:14 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
4015.5eb7399d5f0d2766.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
13 KB
4 KB
133ms
133ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/4015.5eb7399d5f0d2766.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
1fdd8f696eb8c0668a84ba31c96d393021cd5b68ee269c2704d3f0f47eacd8e2

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"47f9d17d1f28abc5cdefe34f5f08ac07"
age
5593
cf-ray
a1eeecd9c95eebb9-YYZ
expires
Wed, 22 Jul 2026 04:40:02 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:12 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
5205.f0d619ba879acd2e.js Show response
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
78 KB
17 KB
133ms
133ms
Script
text/javascript
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/5205.f0d619ba879acd2e.js
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/runtime.888bd258a7933438.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
ea6039f470a15f3c57fc320f5a0683ec41a0d42982e0a26bbbdda68a4a4c9918

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"7cb985c1751c6f68659b00a660e3b59f"
age
9841
cf-ray
a1eeecd9c962ebb9-YYZ
expires
Wed, 22 Jul 2026 03:29:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
text/javascript
last-modified
Fri, 17 Jul 2026 13:48:13 GMT
server
cloudflare
priority
u=1,i=?0
vary
accept-encoding
GET
H3
200
sprite.svg
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/assets/
2 MB
1 MB
101ms
100ms
Other
image/svg+xml
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/assets/sprite.svg
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/main.2bd32f7164550f10.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
4657c89a3ac28f9a49306c904194ade79dc2c2833c3ef0f884f32dd98baebfba

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
W/"d5b80b7aeb599baeb72b9824adb9d030"
age
390135
cf-ray
a1eeecda19f4ebb9-YYZ
expires
Fri, 17 Jul 2026 17:51:00 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
image/svg+xml
last-modified
Fri, 17 Jul 2026 13:48:36 GMT
server
cloudflare
priority
u=3,i
vary
accept-encoding
GET
H3
200
countries Show response
mafiacasino.com/ca/api/v3/registration/
26 KB
4 KB
76ms
75ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/registration/countries?limit=300&offset=0
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
cfc2c295ce468089482403d6ca67d3828a36623650a9bb10aa656c3e33b4a1b5
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-438ef270ff1ad8e3eb5f19a8671a06b7-40cb15ba3018a86b-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
pi2u_npX-_l5szpgmK4j5nEWCrBQAtTwHnVbO5kI

Response headers

x-request-id
2a7fded7-c795-4d10-861f-fad97f394289
content-encoding
br
cf-cache-status
HIT
age
2783
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
cf-ttl
1784683672519
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
application/json; charset=utf-8
last-modified
Wed, 22 Jul 2026 01:26:52 GMT
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
cache-control
s-maxage=86400
x-dns-prefetch-control
off
x-envoy-upstream-service-time
53
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecda3a6eebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
item Show response
mafiacasino.com/ca/api/v3/footer/
354 B
2 KB
66ms
63ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/ca/api/v3/footer/item
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
6e3d31a792ff5461323d1b24eeb360acef26a2b70f40ee73f1898f63c1abcc29
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
X-Content-Type-Options nosniff, nosniff always
X-Frame-Options SAMEORIGIN always
X-Xss-Protection 0, 1; mode=block always

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
visitor-id
FHbruXMwE3bwcVOG_5uT7
sec-ch-ua-mobile
?0
traceparent
00-5c925653b245446c77d77ebbf1d55997-9306db889ef5b056-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
x-request-client-id
_wsjPg8X1UHteSb21ncOhB0tQgQvjK2Hx2Vno3Cb

Response headers

x-request-id
4be3bf6a-2bb3-4052-a8be-500f7836c5dc
content-encoding
br
cf-cache-status
HIT
age
332
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff always
alt-svc
h3=":443"; ma=86400
cf-ttl
1784686124249
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
application/json; charset=utf-8
last-modified
Wed, 22 Jul 2026 02:07:44 GMT
vary
accept-encoding
priority
u=1,i
x-frame-options
SAMEORIGIN always
strict-transport-security
max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains; preload always
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' * ; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://m.cvoz8476l.com https://m.j67z85nx4.com https://static.j67z85nx4.com https://pgf-euy2bt.com https://pgwhois.com https://m.pgwhois.com https://static.pgwhois.com https://static.pgf-euy2bt.com https://m.pgf-euy2bt.com https://in.hotjar.com https://ws5.hotjar.com wss://ws5.hotjar.com https://pg-nmga.com https://m.pg-nmga.com https://static.pg-nmga.com https://pgf-nmu2nd.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://secure.mifinity.com https://demo.mifinity.com https://cdn.switchpayments.com https://1-vbus-eu.ladesk.com https://vars.hotjar.com; img-src 'self' data: https://dev.visualwebsiteoptimizer.com https://my.rtmark.net https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.google.de; manifest-src 'self'; media-src 'self'; report-uri https://60ab6379c3b8cdd26efe1969.endpoint.csper.io/; worker-src 'self';
cache-control
s-maxage=86400
x-dns-prefetch-control
off
x-envoy-upstream-service-time
11
referrer-policy
no-referrer, no-referrer-when-downgrade
x-download-options
noopen
cf-ray
a1eeecda5ab6ebb9-YYZ
access-control-allow-origin
*
x-xss-protection
0, 1; mode=block always
server
cloudflare
GET
H3
200
logo.svg
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/assets/images/
15 KB
6 KB
66ms
64ms
Image
image/svg+xml
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/assets/images/logo.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
4f1a408efd85a4ed4f0d9afe31554dc5bd4f12a2d34ad5f8fe9e4559a4ba7a04

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
W/"6c383094fe45b5df97cf6d895d8f0f60"
age
389990
cf-ray
a1eeecda5ab9ebb9-YYZ
expires
Fri, 17 Jul 2026 17:53:26 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
image/svg+xml
last-modified
Fri, 17 Jul 2026 13:48:27 GMT
server
cloudflare
priority
u=3,i
vary
accept-encoding
GET
H3
200
tab-boxed-scratch-left.ba60e91aa42f256e.webp
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
4 KB
4 KB
64ms
63ms
Image
image/webp
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/tab-boxed-scratch-left.ba60e91aa42f256e.webp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
19700c76b7a192f1a8fac1b70bd1c565d915566bbbfd613c0846f3231edd25a5

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
HIT
etag
"5e25aa284d5134bb3a13e8df122c31b8"
age
4340
expires
Wed, 22 Jul 2026 05:00:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
image/webp
last-modified
Fri, 17 Jul 2026 13:48:43 GMT
vary
accept-encoding
priority
u=3,i
cache-control
public, max-age=14400
cf-ray
a1eeecda6b17ebb9-YYZ
accept-ranges
bytes
content-length
4270
server
cloudflare
GET
H3
200
tab-boxed-scratch-right.b6b6193e0c72dc7a.webp
mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/
3 KB
3 KB
63ms
62ms
Image
image/webp
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/tab-boxed-scratch-right.b6b6193e0c72dc7a.webp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
eeef2227a890fc04646e3ea1c872a8c28799ffbcb3e402fbb64f2eaa76dec2dc

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
HIT
etag
"0dec7c31bca7c724ecd31800162fbe15"
age
4340
expires
Wed, 22 Jul 2026 05:00:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
image/webp
last-modified
Fri, 17 Jul 2026 13:48:43 GMT
vary
accept-encoding
priority
u=3,i
cache-control
public, max-age=14400
cf-ray
a1eeecda6b1debb9-YYZ
accept-ranges
bytes
content-length
3182
server
cloudflare
GET
H2
200
raxoHjafvdAIOju4GcIfJH0i7zi50X3zRtuLNiMS0fSuJk4.woff2
fonts.gstatic.com/s/sofiasansextracondensed/v6/
40 KB
40 KB
50ms
39ms
Font
font/woff2
172.253.115.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/sofiasansextracondensed/v6/raxoHjafvdAIOju4GcIfJH0i7zi50X3zRtuLNiMS0fSuJk4.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f94.1e100.net
Software
sffe /
Resource Hash
4c0443d7e9bc0849364b498e8a0acbbafbfd21e69c504b145540df43c3828596
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

age
9774
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 21 Jul 2027 23:30:22 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 21 Jul 2026 23:30:22 GMT
last-modified
Wed, 10 Sep 2025 16:22:25 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
40520
x-xss-protection
0
server
sffe
POST
H3
200
browser-logs Show response
mafiacasino.com/
15 B
195 B
233ms
221ms
Fetch
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/browser-logs
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

sec-ch-ua-platform
"Linux"
Authorization
Bearer cxtp_vbQJjf7Tyfdg5zj7Qo16RbLtHt6DlF
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
grpc-status,grpc-message
cf-cache-status
DYNAMIC
cf-ray
a1eeecdb0d06ebb9-YYZ
access-control-allow-origin
https://mafiacasino.com
alt-svc
h3=":443"; ma=86400
content-length
15
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
application/json
vary
accept-encoding
server
cloudflare
priority
u=1,i
GET
H3
200
PMj9clZTiuHhkf.svg
mafiacasino.com/dimg/v2/footer/
2 KB
961 B
38ms
37ms
Image
image/svg+xml
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/dimg/v2/footer/PMj9clZTiuHhkf.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
36813feadf12ddf91e71ca2baa4fb8e842a231af2dbd7ba4524ed58943bba533

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-conv-cache-status
MISS
content-encoding
br
cf-cache-status
HIT
etag
W/"18d757198f99b3967655eac3b3f3c4b7"
age
1110377
x-front-cache-status
HIT
cf-ray
a1eeecdb2d81ebb9-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
image/svg+xml
vary
accept-encoding
server
cloudflare
last-modified
Fri, 19 Jun 2026 06:24:13 GMT
priority
u=3,i
GET
H3
200
fbevents.js Show response
connect.facebook.net/en_US/
388 KB
103 KB
184ms
35ms
Script
application/x-javascript
57.144.70.128
Facebook
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: safe-track.pro
URL: https://safe-track.pro/casino_mafia.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.144.70.128 Reston, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
xx-fbcdn-shv-01-xxc1.fbcdn.net
Software
/
Resource Hash
4bddd1578e1f5814c17aadd04b0ee3993e0e3cc22c810d26d4a20f5603b71066
Security Headers
Name Value
Content-Security-Policy default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-k2114O3p';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; preload; includeSubDomains
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy
default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-k2114O3p';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;
cache-control
public, max-age=1200
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=35, rtx=0, c=23, mss=1232, tbw=5101, tp=11, tpl=0, uplat=1, ullat=-1
pragma
public
x-fb-debug
V8rT9n2T10Dc3uGegX0uxnRgSQX8FDDBZOS941EVuGPnf+pjVe4L//5/N1Y6kFYEIWAD+B6hN4HrM8nZWC3+yQ==
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
content-length
105125
x-xss-protection
0
origin-agent-cluster
?1
GET
H2
200
track_casino_mafia.js Show response
safe-track.pro/
2 KB
907 B
198ms
195ms
Script
text/javascript
198.54.115.232
Namecheap
General
Full URL
https://safe-track.pro/track_casino_mafia.js
Requested by
Host: safe-track.pro
URL: https://safe-track.pro/casino_mafia.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.115.232 , United States, ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US),
Reverse DNS
server223-3.web-hosting.com
Software
LiteSpeed /
Resource Hash
b364b2c4553345b925b7777c12f57761169c4f73d4246295fe62313f994dd419

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
accept-ranges
bytes
content-length
735
date
Wed, 22 Jul 2026 02:13:17 GMT
x-turbo-charged-by
LiteSpeed
content-type
text/javascript
last-modified
Fri, 12 Jun 2026 16:05:16 GMT
vary
Accept-Encoding
server
LiteSpeed
GET
H3
200
01kwvbmnwaj7w4x6w6av6r4fvs.json Show response
cdn.iconvert.network/conf/
38 KB
3 KB
57ms
29ms
Fetch
application/json
13.225.196.71
Amazon.com
General
Full URL
https://cdn.iconvert.network/conf/01kwvbmnwaj7w4x6w6av6r4fvs.json
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.225.196.71 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-225-196-71.yul62.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ab8de565af362b46fe9fcdcebaeb21cea243d711bdd45a2e7e34aed6c1e1915d

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
3000
access-control-expose-headers
ETag
content-encoding
br
x-amz-version-id
hM0Pnxszumn9l5149JLfgG3b2VVHWFm3
age
1356674
etag
W/"8d6070238113374d86ef121909fce94e"
access-control-allow-methods
POST, GET, HEAD, PUT
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
2cXGYVzuWW_EdjlbgwvBbI2qpL7O9cS-LJq49qczh3l5PJRZnYLU4w==
date
Mon, 06 Jul 2026 09:22:02 GMT
content-type
application/json
vary
Origin,Accept-Encoding
last-modified
Mon, 06 Jul 2026 09:20:10 GMT
cache-control
max-age=31536000,immutable
via
1.1 9dacf602dd59e90e637b38a79292bc5c.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
YUL62-P4
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H3
200
sync
rtg.rubiconredirect.com/
43 B
798 B
63ms
55ms
Image
image/gif
104.21.19.114
Cloudflare
General
Full URL
https://rtg.rubiconredirect.com/sync?requestedAt=1784686396930&sh=1200&sw=1600&ref=https%3A%2F%2Fmafiacasino.com%2Flogin&lp=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&fp=uid-2cdb3dc9a.441f84303.4a0c00220
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.19.114 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-request-id
75abe02f-6f62-4119-9aba-34df7ddc882d
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=AML7mXyjZJihXXiJCuiExEQ0I4HevL%2FdLhuiAED0kRJQHplHAx5EE1KYMXaZpJEwPjCez6zT6aLoym9%2BBjm4OsOpKAHwkaoI0Uf0Qk955NTNhrZ3B3UKFHtBhybkal5%2FOCKa3F5yKxW7dQ%3D%3D"}]}
x-content-type-options
nosniff
server-timing
cfExtPri
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
image/gif
content-disposition
inline; filename="pixel.gif"; filename*=UTF-8''pixel.gif
x-runtime
0.002176
priority
u=3,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=63072000; includeSubDomains
cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-transfer-encoding
binary
referrer-policy
strict-origin-when-cross-origin
cf-ray
a1eeecdceacda2d9-YYZ
content-length
43
x-xss-protection
0
server
cloudflare
GET
H/1.1
200
OK
ca.html Show response
20874641p.rfihub.com/ Frame 3139
5 KB
6 KB
190ms
31ms
Document
text/html
199.38.167.130
Rocket Fuel Inc.
General
Full URL
https://20874641p.rfihub.com/ca.html?ver=9&rb=55629&ca=20874641&_o=55629&_t=20874641&gpp=%7Bgpp_string_469%7D&gpp_sid=%7BgppSid%7D&gdpr=%7BgdprFlag%7D&gdpr_consent=%7BgdprConsent%7D&pe=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&pf=https%3A%2F%2Fmafiacasino.com%2Flogin&ra=37450207585374007
Requested by
Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
199.38.167.130 , United States, ASN54312 (ROCKETFUEL - Rocket Fuel Inc., US),
Reverse DNS
Software
Jetty(9.4.51.v20230217) /
Resource Hash
7378ee4f754c282196e97ca36adad82f4fc576251bb430f0a49c6779211c460d

Request headers

Referer
https://mafiacasino.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

Cache-Control
no-cache
Content-Length
5014
Content-Type
text/html;charset=utf-8
Date
Wed, 22 Jul 2026 02:13:17 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server
Jetty(9.4.51.v20230217)
GET
H2
200
modules.b3c3d2ffe9c422f77646.js Show response
script.hotjar.com/
229 KB
57 KB
209ms
28ms
Script
application/javascript
13.225.196.122
Amazon.com
General
Full URL
https://script.hotjar.com/modules.b3c3d2ffe9c422f77646.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-6463121.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.196.122 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-225-196-122.yul62.r.cloudfront.net
Software
/
Resource Hash
96317501ab9492f9066e5623d7e87c6012ee8c15435feb319acaed207c4195f4
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
none
content-encoding
br
etag
"8fed7004aed317eb97a0b55d07a1d30d"
age
55509
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-amz-cf-id
pY9vkB-1qczmdWyWMaLgXy5GG6XsZCAVh32jkN1JOe35506wLa9LMw==
date
Tue, 21 Jul 2026 10:48:08 GMT
content-type
application/javascript; charset=utf-8
last-modified
Tue, 21 Jul 2026 10:47:43 GMT
vary
Accept-Encoding
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
max-age=31536000
cross-origin-resource-policy
cross-origin
via
1.1 c967b84deb6944b2848e7f825db5e926.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
57598
x-amz-cf-pop
YUL62-P4
GET
H2
200
syncframe Show response
gum.criteo.com/ Frame C270
12 KB
5 KB
191ms
34ms
Document
text/html
74.119.117.62
Criteo Corp.
General
Full URL
https://gum.criteo.com/syncframe?topUrl=mafiacasino.com&origin=onetag
Requested by
Host: dynamic.criteo.com
URL: https://dynamic.criteo.com/js/ld/ld.js?a=125125&a=125126&a=125127&a=125128&a=125129&a=125130
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.62 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
36ce068a4107077cee7072231c246281cd2a208444ed215337b5c3f4ec1b9a3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://mafiacasino.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

cache-control
private, no-cache, max-age=0, must-revalidate
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 22 Jul 2026 02:13:16 GMT
server
Kestrel
server-processing-duration-in-ticks
363090
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
x-robots-tag
noindex
POST
H2
204
collect Show response
www.google-analytics.com/g/
0
557 B
170ms
46ms
Fetch
text/plain
172.253.63.101
Google LLC
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-81P3YM2SHW&gtm=45je67k1v9220580783z89220570210za20gzb9220570210zd9220570210&_p=1784686394829&gcs=G100&gcd=13p3p3p3p5l1&npa=1&dma_cps=-&dma=0&are=1&cid=1437553754.1784686397&frm=0&ngs=1&pscdl=denied&rcb=19&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B150.0.7871.128%7CGoogle%2520Chrome%3B150.0.7871.128%7CNot%253BA%253DBrand%3B8.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=en-ca&_s=1&tag_exp=115616986~115938465~115938469~118897920~118897930~119773332~119896802&sid=1784686397&sct=1&seg=0&dl=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&dr=https%3A%2F%2Fmafiacasino.com%2Flogin&dt=MafiaCasino%20Online%20Casino%20%26%20Online%20Betting%20Sportsbook&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2745
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.101 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bi-in-f101.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:139:0
report-to
{"group":"ascnsrsggc:139:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:139:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://mafiacasino.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:139:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
text/plain
server
Golfe2
POST
H2
204
collect Show response
www.google-analytics.com/g/
0
57 B
172ms
48ms
Fetch
text/plain
172.253.63.101
Google LLC
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-81P3YM2SHW&gtm=45je67k1v9220580783z89220570210za20gzb9220570210zd9220570210&_p=1784686394829&gcs=G100&gcd=13p3p3p3p5l1&npa=1&dma_cps=-&dma=0&are=1&cid=1437553754.1784686397&frm=0&ngs=1&pscdl=denied&rcb=19&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B150.0.7871.128%7CGoogle%2520Chrome%3B150.0.7871.128%7CNot%253BA%253DBrand%3B8.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=en-ca&_s=2&tag_exp=115616986~115938465~115938469~118897920~118897930~119773332~119896802&sid=1784686397&sct=1&seg=0&dl=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&dr=https%3A%2F%2Fmafiacasino.com%2Flogin&dt=MafiaCasino%20Online%20Casino%20%26%20Online%20Betting%20Sportsbook&en=clickEvent_emailAutoTabSelect&ep.action=Fast%20Login%20Email%20Tab%20Select&ep.label=Fast%20Login%20Email%20Tab%20Select&ep.category=FastRegistrationLogin&ep.eventType=manual&ep.eventName=emailAutoTabSelect&_et=6&up.visitorId=FHbruXMwE3bwcVOG_5uT7&tfd=2763
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.101 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bi-in-f101.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:139:0
report-to
{"group":"ascnsrsggc:139:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:139:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://mafiacasino.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:139:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
text/plain
server
Golfe2
POST
H3
200
browser-logs Show response
mafiacasino.com/
15 B
195 B
300ms
290ms
Fetch
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/browser-logs
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

sec-ch-ua-platform
"Linux"
Authorization
Bearer cxtp_vbQJjf7Tyfdg5zj7Qo16RbLtHt6DlF
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
grpc-status,grpc-message
cf-cache-status
DYNAMIC
cf-ray
a1eeecddddecebb9-YYZ
access-control-allow-origin
https://mafiacasino.com
alt-svc
h3=":443"; ma=86400
content-length
15
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
application/json
vary
accept-encoding
server
cloudflare
priority
u=1,i
POST
H2
204
collect Show response
www.google-analytics.com/g/
0
57 B
146ms
48ms
Fetch
text/plain
172.253.63.101
Google LLC
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-81P3YM2SHW&gtm=45je67k1v9220580783za20gzb9220570210zd9220570210&_p=1784686394829&gcs=G100&gcd=13p3p3p3p5l1&npa=1&dma_cps=-&dma=0&gdid=dMmY1Mm&_eu=AEA&ae=a&are=1&cid=1437553754.1784686397&frm=0&ngs=1&pscdl=denied&rcb=19&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B150.0.7871.128%7CGoogle%2520Chrome%3B150.0.7871.128%7CNot%253BA%253DBrand%3B8.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=en-ca&_s=3&tag_exp=115616986~115938465~115938469~118897920~118897930~119773332~119896802&sid=1784686397&sct=1&seg=0&dl=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&dr=https%3A%2F%2Fmafiacasino.com%2Flogin&dt=MafiaCasino%20Online%20Casino%20%26%20Online%20Betting%20Sportsbook&en=scroll&epn.percent_scrolled=90&_et=7&tfd=2785
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.101 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bi-in-f101.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:139:0
report-to
{"group":"ascnsrsggc:139:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:139:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://mafiacasino.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:139:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
text/plain
server
Golfe2
GET
H3
200
main.js Show response
cdn.iconvert.network/client/5.2.1/
111 KB
38 KB
29ms
28ms
Script
text/javascript
13.225.196.71
Amazon.com
General
Full URL
https://cdn.iconvert.network/client/5.2.1/main.js
Requested by
Host: cdn.iconvert.network
URL: https://cdn.iconvert.network/code/853e630b-7404-44f8-a608-90d9cadf6127.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.225.196.71 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-225-196-71.yul62.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c737a609535bd63a86737bdf1b2a1122da357cfdfd293034a8f9fa300134f567

Request headers

Origin
https://mafiacasino.com
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
3000
access-control-expose-headers
ETag
content-encoding
br
x-amz-version-id
FGxpv.wVk2bPKqncDr5TbbADhVPk7vdU
age
1356675
etag
W/"3ecda1bf30eff9a7036eb706aff3d328"
access-control-allow-methods
POST, GET, HEAD, PUT
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
2bB-RGtzJs9hb85CF5aCoOEzFuNMVI2i6J7dQ0TkjHjgiX1Cu0RoYQ==
date
Mon, 06 Jul 2026 09:22:03 GMT
content-type
text/javascript
vary
Origin,Accept-Encoding
last-modified
Tue, 30 Jun 2026 17:35:56 GMT
cache-control
max-age=31536000,immutable
via
1.1 9dacf602dd59e90e637b38a79292bc5c.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
YUL62-P4
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H2
200
/ Show response
a1.adform.net/Serving/TrackPoint/
Redirect Chain
  • https://a1.adform.net/Serving/TrackPoint/?pm=3960913&ADFPageName=mafiacasino.com%2Fca&ADFdivider=%7C&ord=82298351306&ADFtpmode=2&itm=eyJpdG1zIjpbeyJwaWQiOiJjYSJ9XX0&loc=https%3A%2F%2Fmafiacasino.co...
  • https://a1.adform.net/Serving/TrackPoint/?CC=1&pm=3960913&ADFPageName=mafiacasino.com%2Fca&ADFdivider=%7C&ord=82298351306&ADFtpmode=2&itm=eyJpdG1zIjpbeyJwaWQiOiJjYSJ9XX0&loc=https%3A%2F%2Fmafiacasi...
819 B
1 KB
36ms
36ms
Script
text/javascript
185.167.164.53
ADFORM Adform A/S
General
Full URL
https://a1.adform.net/Serving/TrackPoint/?CC=1&pm=3960913&ADFPageName=mafiacasino.com%2Fca&ADFdivider=%7C&ord=82298351306&ADFtpmode=2&itm=eyJpdG1zIjpbeyJwaWQiOiJjYSJ9XX0&loc=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&CPref=https%3A%2F%2Fmafiacasino.com%2Flogin&Set1=en-CA%7Cen-CA%7C1600x1200%7C24
Protocol
H2
Server
185.167.164.53 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
461041dc2d19bd05017eb59c4612f98834b1ada2bbac2d4683273702dd74c524
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://mafiacasino.com/

Response headers

access-control-max-age
86400
content-encoding
gzip
access-control-allow-methods
GET,POST
expires
-1
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-origin
*
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
location
https://a1.adform.net/Serving/TrackPoint/?CC=1&pm=3960913&ADFPageName=mafiacasino.com%2Fca&ADFdivider=%7C&ord=82298351306&ADFtpmode=2&itm=eyJpdG1zIjpbeyJwaWQiOiJjYSJ9XX0&loc=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&CPref=https%3A%2F%2Fmafiacasino.com%2Flogin&Set1=en-CA%7Cen-CA%7C1600x1200%7C24
pragma
no-cache
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-methods
GET,POST
expires
-1
access-control-allow-origin
*
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date
Wed, 22 Jul 2026 02:13:17 GMT
server
nginx
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
OPTIONS
H2
200
tp2
event.iconvert.network/com.snowplowanalytics.snowplow/ Frame
0
0
455ms
120ms
Preflight
63.33.10.76
Amazon.com
General
Full URL
https://event.iconvert.network/com.snowplowanalytics.snowplow/tp2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.33.10.76 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-33-10-76.eu-west-1.compute.amazonaws.com
Software
akka-http/10.2.9 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://mafiacasino.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type, SP-Anonymous
access-control-allow-origin
https://mafiacasino.com
access-control-max-age
3600
content-length
0
date
Wed, 22 Jul 2026 02:13:17 GMT
server
akka-http/10.2.9
POST
H2
200
tp2 Show response
event.iconvert.network/com.snowplowanalytics.snowplow/
2 B
328 B
1383ms
122ms
Fetch
text/plain
63.33.10.76
Amazon.com
General
Full URL
https://event.iconvert.network/com.snowplowanalytics.snowplow/tp2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.33.10.76 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-33-10-76.eu-west-1.compute.amazonaws.com
Software
akka-http/10.2.9 /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
content-type
application/json; charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://mafiacasino.com
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
content-length
2
date
Wed, 22 Jul 2026 02:13:19 GMT
content-type
text/plain; charset=UTF-8
server
akka-http/10.2.9
access-control-allow-credentials
true
GET
H2
200
json Show response
gum.criteo.com/sid/ Frame C270
417 B
912 B
38ms
38ms
Fetch
application/json
74.119.117.62
Criteo Corp.
General
Full URL
https://gum.criteo.com/sid/json?origin=onetag&domain=mafiacasino.com&sn=ChromeSyncframe&so=undefined&topUrl=mafiacasino.com
Requested by
Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?topUrl=mafiacasino.com&origin=onetag
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.62 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
47029363167ece75cffaa763455ff8cfecf9a5514c0233c36f42cc17484bf037
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://gum.criteo.com/syncframe?topUrl=mafiacasino.com&origin=onetag
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
content-encoding
gzip
pragma
no-cache
server-processing-duration-in-ticks
738910
expires
0
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
Kestrel
GET
H2
200
pixel
live.rezync.com/ Frame 3139
0
622 B
277ms
134ms
Image
text/html
3.167.88.60
Amazon.com
General
Full URL
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=970033204402624982&referrer=https%3A%2F%2Fmafiacasino.com%2Flogin&forward=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.167.88.60 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-3-167-88-60.iad55.r.cloudfront.net
Software
lighttpd/1.4.79 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://20874641p.rfihub.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 1f0befe1f0c7d5efec2c028b0e0af7ea.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Miss from cloudfront
content-length
0
x-amz-cf-id
wD390ESl3PLiTsQrCYTWmuqGtvMSbk11U6xWTregD51x1rDr-XzEbw==
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
text/html; charset=utf-8
vary
Cookie
server
lighttpd/1.4.79
x-amz-cf-pop
IAD55-P6
GET
H/1.1
200
OK
cm
a.rfihub.com/ Frame 3139
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=OTcwMDMzMjA0NDAyNjI0OTgy&forward=
  • https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=OTcwMDMzMjA0NDAyNjI0OTgy&forward=&google_tc=
  • https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEC1Z9wTcWMVCffj0sfy8XhU&google_cver=1
42 B
1003 B
1116ms
30ms
Image
image/gif
199.38.167.131
Rocket Fuel Inc.
General
Full URL
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEC1Z9wTcWMVCffj0sfy8XhU&google_cver=1
Protocol
HTTP/1.1
Server
199.38.167.131 , United States, ASN54312 (ROCKETFUEL - Rocket Fuel Inc., US),
Reverse DNS
Software
Jetty(9.4.51.v20230217) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://20874641p.rfihub.com/

Response headers

Cache-Control
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length
42
Date
Wed, 22 Jul 2026 02:13:18 GMT
Content-Type
image/gif
Server
Jetty(9.4.51.v20230217)

Redirect headers

cache-control
no-cache, must-revalidate
location
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEC1Z9wTcWMVCffj0sfy8XhU&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
311
date
Wed, 22 Jul 2026 02:13:17 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
bounce
ib.adnxs.com/ Frame 3139
Redirect Chain
  • https://ib.adnxs.com/setuid?entity=18&code=970033204402624982&gdpr=&gdpr_consent=%7BgdprConsent%7D&redir=
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D970033204402624982%26gdpr%3D%26gdpr_consent%3D%257BgdprConsent%257D%26redir%3D
43 B
1 KB
44ms
42ms
Image
image/gif
68.67.161.208
Xandr Inc.
General
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D970033204402624982%26gdpr%3D%26gdpr_consent%3D%257BgdprConsent%257D%26redir%3D
Protocol
H2
Server
68.67.161.208 Feasterville, United States, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),
Reverse DNS
806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://20874641p.rfihub.com/

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
154.47.17.42; 154.47.17.42; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
968c274f-b5ac-45b8-afe4-ac15f1d24110
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:17 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.25.5

Redirect headers

cache-control
no-store, no-cache, private
location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D970033204402624982%26gdpr%3D%26gdpr_consent%3D%257BgdprConsent%257D%26redir%3D
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin
154.47.17.42; 154.47.17.42; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid
6f13530a-c2fe-4c06-8c1c-e44c1da6b806
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:17 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H2
200
demconf.jpg
dpm.demdex.net/ Frame 3139
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=1121&dpuuid=970033204402624982&redir=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=970033204402624982&redir=
42 B
716 B
50ms
49ms
Image
image/gif
100.61.34.68
Amazon.com
General
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=970033204402624982&redir=
Protocol
H2
Server
100.61.34.68 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-61-34-68.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://20874641p.rfihub.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs
dcs-prod-va6-2-v088-016b75941.edge-va6.demdex.com 4 ms
content-encoding
gzip
pragma
no-cache
x-content-type-options
nosniff
x-tid
fA1iBe0kRkE=
expires
Thu, 01 Jan 1970 00:00:00 UTC
content-length
59
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
image/gif

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=970033204402624982&redir=
dcs
dcs-prod-va6-2-v088-0889c5d60.edge-va6.demdex.com 0 ms
pragma
no-cache
x-tid
TbPYyczwQgo=
expires
Thu, 01 Jan 1970 00:00:00 UTC
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Wed, 22 Jul 2026 02:13:17 GMT
GET
H2
200
Pug
image2.pubmatic.com/AdServer/ Frame 3139
42 B
517 B
215ms
73ms
Image
image/gif
207.65.32.88
PubMatic
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw==&piggybackCookie=970033204402624982&r=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.32.88 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://20874641p.rfihub.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
image/gif; charset=utf-8
server
nginx
GET
H2
200
sd
us-u.openx.net/w/1.0/ Frame 3139
43 B
258 B
183ms
53ms
Image
image/gif
35.244.159.8
Google LLC
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073062&val=970033204402624982&r=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://20874641p.rfihub.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
154.47.17.42
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
image/gif
vary
Accept
GET
H/1.1
200
OK
/
ps.eyeota.net/match/bounce/ Frame 3139
Redirect Chain
  • https://p.rfihub.com/cm?pub=24472&in=1&gdpr=&gdpr_consent=%7BgdprConsent%7D
  • https://ps.eyeota.net/match?uid=970033204402624982&bid=omt9pi0
  • https://ps.eyeota.net/match/bounce/?uid=970033204402624982&bid=omt9pi0
70 B
450 B
71ms
36ms
Image
image/gif
100.59.229.44
Amazon.com
General
Full URL
https://ps.eyeota.net/match/bounce/?uid=970033204402624982&bid=omt9pi0
Protocol
HTTP/1.1
Server
100.59.229.44 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-59-229-44.compute-1.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://20874641p.rfihub.com/

Response headers

content-length
70
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif

Redirect headers

location
/match/bounce/?uid=970033204402624982&bid=omt9pi0
content-length
0
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
date
Wed, 22 Jul 2026 02:13:18 GMT
GET
H2
200
cksync.php
contextual.media.net/ Frame 3139
43 B
602 B
257ms
117ms
Image
image/gif
23.221.252.28
Akamai Technologies
General
Full URL
https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=970033204402624982
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.221.252.28 Ashburn, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-221-252-28.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://20874641p.rfihub.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=0, no-cache, no-store
timing-allow-origin
*
pragma
no-cache
expires
Wed, 22 Jul 2026 02:13:17 GMT
alt-svc
h3=":443"; ma=2629800
content-length
43
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
image/gif
vary
Accept-Encoding
GET
H2
200
/
wt.rqtrk.eu/ Frame 3139
43 B
350 B
195ms
59ms
Image
image/gif
51.222.241.145
OVH OVH SAS
General
Full URL
https://wt.rqtrk.eu/?pid=afd6afd5-a807-471d-940d-aa3c19fc7dca&src=www&type=100&sid=1&cb=MEKX9dgrKf9i&uid=970033204402624982&url=https%3A%2F%2Fmafiacasino.com%2Flogin&gdpr=&gdpr_pd=0&gdpr_consent=%7BgdprConsent%7D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.222.241.145 , Canada, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
haproxy-ca-013.roqad.pl
Software
istio-envoy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://20874641p.rfihub.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache,private
pragma
no-cache
x-envoy-upstream-service-time
0
expires
Wed, 22 Jul 2026 02:13:16 GMT
content-length
43
p3p
CP="NOI DSP COR DEVa PSAa PSDa OUR BUS UNI COM NAV STA"
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
image/gif
server
istio-envoy
GET

sync
thrtle.com/ Frame 3139
Redirect Chain
  • https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=970033204402624982
  • https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=970033204402624982&_li_chk=true&previous_uuid=f539a137813042408ed05ffc143770ff
  • https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=f539a137-8130-4240-8ed0-5ffc143770ff&us_privacy=1YN-
0
0


GET
H3
200
rum
dsum-sec.casalemedia.com/ Frame 3139
Redirect Chain
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=970033204402624982&forward=
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=970033204402624982&forward=&C=1
43 B
742 B
57ms
56ms
Image
image/gif
104.18.27.193
Cloudflare
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=970033204402624982&forward=&C=1
Protocol
H3
Server
104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://20874641p.rfihub.com/

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=9JsAJ7Y%2F4MGiU4%2B5PnYwwoL%2B3KubFCAQzPNB5tgTEIZhrrCqSCuW%2FuTbZyV2KrfNCaxK6AIDzhGK8JUiS6DyqTQifVjFAsp4TIY3swDvY%2BquFL0hyVudABhG9tJ4IIeGJT6teP9reme8YA%3D%3D"}]}
cf-ray
a1eeece00fa27091-YYZ
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
image/gif
server
cloudflare
priority
u=1,i

Redirect headers

cache-control
no-cache
location
/rum?cm_dsp_id=57&external_user_id=970033204402624982&forward=&C=1
cf-cache-status
DYNAMIC
pragma
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=MqKmiAUvOupDikzTVppthszmMvIsq94P3zi937XuR5kQ6apW%2FozOIlq2ZE30HjHqNZqUjjCcN6XuYHL%2F%2FxVXCKVCONUH2mUkIFJS7vkNU7DEka2E3%2FJ1q35VY5woDi%2F214sdCWO1o02Y0g%3D%3D"}]}
cf-ray
a1eeecdfbf3e7091-YYZ
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Wed, 22 Jul 2026 02:13:17 GMT
server
cloudflare
priority
u=1,i
GET

360947.gif
idsync.rlcdn.com/ Frame 3139
0
0


GET
H2
200
sync
partners.tremorhub.com/ Frame 3139
43 B
175 B
435ms
44ms
Image
image/gif
100.60.188.223
Amazon.com
General
Full URL
https://partners.tremorhub.com/sync?UIRF=970033204402624982&r=GJNtq_lLkGMF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
100.60.188.223 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-60-188-223.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://20874641p.rfihub.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
image/gif
server
nginx
GET

g.pixel
aa.agkn.com/adscores/ Frame 3139
0
0


GET
H2
200
sync
x.bidswitch.net/ul_cb/ Frame 3139
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=970033204402624982&expires=30&gdpr=&gdpr_consent=%7BgdprConsent%7D&gdpr_pd={GDPR_PD}
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=970033204402624982&expires=30&gdpr=&gdpr_consent=%7BgdprConsent%7D&gdpr_pd={GDPR_PD}
43 B
288 B
141ms
141ms
Image
image/gif
35.211.202.130
YOUTUBE Google Ir...
General
Full URL
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=970033204402624982&expires=30&gdpr=&gdpr_consent=%7BgdprConsent%7D&gdpr_pd={GDPR_PD}
Protocol
H2
Server
35.211.202.130 North Charleston, United States, ASN43515 (YOUTUBE Google Ireland Limited, IE),
Reverse DNS
130.202.211.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://20874641p.rfihub.com/

Response headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000
content-length
43
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
image/gif

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=970033204402624982&expires=30&gdpr=&gdpr_consent=%7BgdprConsent%7D&gdpr_pd={GDPR_PD}
content-length
0
alt-svc
h3=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:17 GMT
GET
H2
200
/
sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/ Frame 3139
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=amAnPgAAAJihpwBD
85 B
172 B
19ms
18ms
Image
image/png
151.101.194.49
Fastly
General
Full URL
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=amAnPgAAAJihpwBD
Protocol
H2
Server
151.101.194.49 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://20874641p.rfihub.com/

Response headers

x-robots-tag
noindex
cache-control
no-cache
x-timer
S1784686398.428621,VS0,VE0
age
3117
pragma
no-cache
via
1.1 varnish
accept-ranges
bytes
x-cache
HIT
content-length
85
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/png
x-served-by
cache-yyz4579-YYZ
server
Jetty(9.4.35.v20201120)
x-cache-hits
13268

Redirect headers

x-robots-tag
noindex
cache-control
no-cache
location
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=amAnPgAAAJihpwBD
x-timer
S1784686398.387567,VS0,VE22
pragma
no-cache
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length
0
date
Wed, 22 Jul 2026 02:13:18 GMT
x-served-by
cache-yyz4579-YYZ
server
Jetty(9.4.35.v20201120)
x-cache-hits
0
GET
H2
200
tracker.js Show response
tracker.ads.sportradar.com/dist/
27 KB
7 KB
463ms
452ms
Script
application/javascript
23.48.203.44
AKAMAI-ASN1 Akama...
General
Full URL
https://tracker.ads.sportradar.com/dist/tracker.js
Requested by
Host: tm.ads.sportradar.com
URL: https://tm.ads.sportradar.com/dist/tag-manager.js?id=STM-AAABBF
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.48.203.44 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-48-203-44.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2522e3f24f318e5c2d998482e9dbb933566aa4eb8b55bccbfff48c91505d27ba

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

vary
Accept-Encoding
cache-control
max-age=900, public
content-encoding
gzip
x-amz-version-id
3v06qycN93gfZzupU0Hoyc9HCdrMI3Bd
etag
"aabe4acdb23c936870089af58cfefc81"
accept-ranges
bytes
content-length
6455
x-amz-cf-id
mRZv8ial_p58h7Rl9uCp0cnsdaYOjcWYs9bjMOgZSnNSYv2dSvHDeg==
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
application/javascript
last-modified
Wed, 25 Feb 2026 07:42:43 GMT
server
AmazonS3
x-amz-cf-pop
MCI50-P4
x-amz-server-side-encryption
AES256
GET
H2
200
pixel Show response
a.sportradarserving.com/ul_cb/
Redirect Chain
  • https://a.sportradarserving.com/pixel?type=js&aid=3212&id=1002438
  • https://a.sportradarserving.com/ul_cb/pixel?type=js&aid=3212&id=1002438
1 KB
2 KB
153ms
152ms
Script
text/javascript
35.211.155.243
YOUTUBE Google Ir...
General
Full URL
https://a.sportradarserving.com/ul_cb/pixel?type=js&aid=3212&id=1002438
Protocol
H2
Server
35.211.155.243 North Charleston, United States, ASN43515 (YOUTUBE Google Ireland Limited, IE),
Reverse DNS
243.155.211.35.bc.googleusercontent.com
Software
/
Resource Hash
4ca010c8509157ddcca054ae1cad78d04d6478897abf8dd484e4b4628893eee6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://mafiacasino.com/

Response headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1528
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
text/javascript; charset=UTF-8

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
https://a.sportradarserving.com/ul_cb/pixel?type=js&aid=3212&id=1002438
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:17 GMT
GET
H2
200
event Show response
sslwidget.criteo.com/
27 KB
4 KB
215ms
68ms
Script
application/x-javascript
74.119.117.57
Criteo Corp.
General
Full URL
https://sslwidget.criteo.com/event?a=%5B125125%2C125126%2C125127%2C125128%2C125129%2C125130%5D&v=5.46.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvh%26tms%3DCriteo%2520GTM%2520Enhanced%2520(Leads)%2520-%2520v5&p2=e%3Ddis%26a%3D%255B125125%252C125126%252C125127%252C125128%252C125129%252C125130%255D&bundle=hmfDYV9WcURpeDhZNVZUQU9vZFJqMmROSHdnRk91V0N1Z0JDVHNHWVNTOFZsbVE2WmJFVTJCejU4Q2w5ODFsU2Vyb1lBQ3RqU0JIZVEyUDMyJTJGUEtlNyUyQnZ1YlN5eVZFUFNxSDhRYldwN0cwamxKUG5SYWlROWNxZ3ZGNndka0lVSzNGTmxXa2V3a3RSdGZXcTl3cUJiQUNmZ1pBJTNEJTNE&tld=mafiacasino.com&dy=1&fu=https%253A%252F%252Fmafiacasino.com%252Fca%252Flogin&pu=https%253A%252F%252Fmafiacasino.com%252Flogin&ceid=2412442e-8b95-424e-b20e-dce55c2493a6
Requested by
Host: dynamic.criteo.com
URL: https://dynamic.criteo.com/js/ld/ld.js?a=125125&a=125126&a=125127&a=125128&a=125129&a=125130
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
e451c1a59800168b5da0128c2ab78676d773ad360b6077b0337b0e93f59b3467
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
content-encoding
gzip
pragma
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
35235023
expires
0
access-control-allow-origin
*
p3p
NON DSP COR CURa PSA PSD OUR BUS NAV STA
date
Wed, 22 Jul 2026 02:13:16 GMT
content-type
application/x-javascript
server
Kestrel
GET
H3
200
2047499333091544 Show response
connect.facebook.net/signals/config/
9 KB
2 KB
102ms
102ms
Script
application/x-javascript
57.144.70.128
Facebook
General
Full URL
https://connect.facebook.net/signals/config/2047499333091544?v=2.9.359&r=stable&domain=mafiacasino.com&hme=db7c4844507b728f524bbfb5449eda841f7f67300bf2850aee64b78febf25c48&ex_m=107%2C208%2C158%2C22%2C73%2C74%2C149%2C69%2C68%2C11%2C167%2C93%2C16%2C141%2C130%2C39%2C76%2C81%2C137%2C163%2C169%2C26%2C27%2C28%2C30%2C48%2C150%2C78%2C115%2C18%2C20%2C44%2C40%2C42%2C41%2C86%2C95%2C99%2C113%2C148%2C151%2C46%2C114%2C24%2C21%2C122%2C70%2C36%2C153%2C152%2C154%2C145%2C143%2C25%2C35%2C59%2C112%2C165%2C71%2C17%2C156%2C117%2C84%2C67%2C19%2C88%2C89%2C119%2C87%2C139%2C138%2C142%2C164%2C34%2C49%2C116%2C47%2C8%2C4%2C5%2C7%2C6%2C3%2C94%2C104%2C170%2C175%2C222%2C75%2C235%2C234%2C233%2C23%2C33%2C55%2C106%2C61%2C10%2C64%2C100%2C101%2C102%2C108%2C133%2C31%2C29%2C135%2C136%2C132%2C131%2C159%2C77%2C162%2C160%2C161%2C50%2C60%2C126%2C15%2C166%2C45%2C281%2C282%2C280%2C295%2C311%2C215%2C204%2C62%2C205%2C203%2C314%2C305%2C52%2C216%2C110%2C134%2C83%2C124%2C54%2C123%2C129%2C128%2C58%2C65%2C63%2C155%2C79%2C80%2C118%2C37%2C32%2C53%2C56%2C103%2C168%2C1%2C127%2C14%2C125%2C12%2C2%2C57%2C96%2C66%2C121%2C92%2C91%2C171%2C172%2C97%2C98%2C9%2C105%2C51%2C146%2C90%2C82%2C72%2C120%2C109%2C43%2C147%2C0%2C85%2C140%2C144%2C157%2C38%2C111%2C13%2C173
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.144.70.128 Reston, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
xx-fbcdn-shv-01-xxc1.fbcdn.net
Software
/
Resource Hash
a557e5f7ae0fdd7e0c9c124b6bdb2288ee2d293ae1d7238ab4f9ba3650593282
Security Headers
Name Value
Content-Security-Policy default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-fZJKOpRU';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; preload; includeSubDomains
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy
default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-fZJKOpRU';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;
cache-control
public, max-age=1200
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=32, rtx=0, c=103, mss=1232, tbw=115421, tp=104, tpl=0, uplat=67, ullat=0
pragma
public
x-fb-debug
O099/TlE5J8XOps80IXwQ6bEKrhfF+W7msxTMcv9Dc4MVC+8EbHg3LbPpY9rByQYwfVmz4lqThYzjHtVBslFEQ==
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
x-xss-protection
0
origin-agent-cluster
?1
GET
H2
200
pixels Show response
c1.adform.net/imatch/ Frame 7ECD
4 KB
2 KB
356ms
35ms
Document
text/html
185.167.164.38
ADFORM Adform A/S
General
Full URL
https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Requested by
Host: a1.adform.net
URL: https://a1.adform.net/Serving/TrackPoint/?pm=3960913&ADFPageName=mafiacasino.com%2Fca&ADFdivider=%7C&ord=82298351306&ADFtpmode=2&itm=eyJpdG1zIjpbeyJwaWQiOiJjYSJ9XX0&loc=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&CPref=https%3A%2F%2Fmafiacasino.com%2Flogin&Set1=en-CA%7Cen-CA%7C1600x1200%7C24
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.167.164.38 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
1a4cc0a43d8faae77be3ef2987bbf0b952816a597a85189e4e2458abd0b057c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://mafiacasino.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 22 Jul 2026 02:13:17 GMT
expires
-1
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
GET
H2
200
/
a1.seadform.net/serving/cookie/sync/
35 B
667 B
3962ms
69ms
Image
image/gif
185.167.164.48
ADFORM Adform A/S
General
Full URL
https://a1.seadform.net/serving/cookie/sync/?uid=1900642661338238831&stamp=VSx8CmrOvbYDvP-67D9Y4w2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.167.164.48 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-methods
GET,POST
expires
-1
access-control-allow-origin
*
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
vary
*
server
nginx
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
GET

8f1a9315-a727-48b4-99f3-b410dbefefd7
https://mafiacasino.com/
0
0


POST
H3
200
/ Show response
mafiacasino.com/cdn/edge/dd/js/
236 B
451 B
76ms
74ms
XHR
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/cdn/edge/dd/js/
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
96c18febc49ca283a3897d45f0fc6d9cc5e52b40bf8b363087acbba352c6c912
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

traceparent
00-d74887784b0019076b794c3d265f8f60-d67adec84c4ef513-01
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-type
application/x-www-form-urlencoded
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache, no-store, must-revalidate
content-encoding
br
cf-cache-status
DYNAMIC
pragma
no-cache
cf-ray
a1eeece169abebb9-YYZ
expires
0
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
application/json;charset=utf-8
vary
accept-encoding
server
cloudflare
priority
u=1,i
GET
H2
200
sync
x.bidswitch.net/ul_cb/ Frame 4B69
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
43 B
289 B
154ms
154ms
Image
image/gif
35.211.202.130
YOUTUBE Google Ir...
General
Full URL
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Protocol
H2
Server
35.211.202.130 North Charleston, United States, ASN43515 (YOUTUBE Google Ireland Limited, IE),
Reverse DNS
130.202.211.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:18 GMT
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 4B69
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzb...
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
43 B
813 B
36ms
35ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-cache, must-revalidate
location
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
398
date
Wed, 22 Jul 2026 02:13:17 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame 4B69
Redirect Chain
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
43 B
803 B
36ms
36ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:20 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
location
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
154.47.17.42; 154.47.17.42; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
5b240e45-c3cb-4619-be8e-9121f03f144e
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:20 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H2
204
/
partner.mediawallahscript.com/ Frame 4B69
Redirect Chain
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=fc1d52c8-50a3-4c1e-bcca-d724516...
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=fc1d52c8-50a3-4c1...
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile...
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=453968853
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=vxsrv3i&ttd_tpi=1
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=10ca1bb6-95f7-4722-a1e9-cf79bafb892e&tag_format=img&tag_action=sync&cb=
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb5c80b0-8572-11f1-a3f7-0bef8b7b55cd
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_r...
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3D...
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=89086a60-2746-4100-8399-970d0fadd8ef&tag_format=img&tag_action=sync
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=33
0
406 B
54ms
51ms
Image
text/plain
67.202.16.78
Amazon.com
General
Full URL
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=33
Protocol
H2
Server
67.202.16.78 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-67-202-16-78.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

expires
Sat, 26 Jul 1997 05:00:00 GMT
cache-control
private, no-cache, must-revalidate, no-store, max-age=0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date
Wed, 22 Jul 2026 02:13:30 GMT
server
nginx

Redirect headers

strict-transport-security
max-age=2592000; includeSubDomains
location
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=33
Content-Length
0
Date
Wed, 22 Jul 2026 02:13:30 GMT
Connection
keep-alive
Server
gunicorn
GET
H2
200
SPug
simage4.pubmatic.com/AdServer/ Frame 4B69
0
396 B
3866ms
69ms
Image
text/plain
8.28.7.84
PubMatic
General
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=167352&partnerUID=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:21 GMT
server
nginx
GET
H2
200
cksync.php
cs.media.net/ Frame 4B69
43 B
538 B
3865ms
69ms
Image
image/gif
35.227.244.76
Google LLC
General
Full URL
https://cs.media.net/cksync.php?cs=3&type=crt&ovsid=k-pypeLEeroCOCSUKVjb8zA1-5feYUNB0JF_UGKQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.76 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
76.244.227.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
vary
Accept-Encoding
GET
H2
200
qmap
sync.crwdcntrl.net/ Frame 4B69
Redirect Chain
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=5vwwNV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBYzZrTFB2aTgwRnBQJTJGZHk4akpZTnY&gdpr=0&gdpr_consent=&lac=y
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=5vwwNV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBYzZrTFB2aTgwRnBQJTJGZHk4akpZTnY&gdpr=0&gdpr_consent=&lac=y&ct=y
49 B
547 B
65ms
65ms
Image
image/gif
98.85.140.86
Amazon.com
General
Full URL
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=5vwwNV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBYzZrTFB2aTgwRnBQJTJGZHk4akpZTnY&gdpr=0&gdpr_consent=&lac=y&ct=y
Protocol
H2
Server
98.85.140.86 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-98-85-140-86.compute-1.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
pragma
no-cache
expires
0
access-control-allow-origin
*
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
49
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif

Redirect headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
location
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=5vwwNV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBYzZrTFB2aTgwRnBQJTJGZHk4akpZTnY&gdpr=0&gdpr_consent=&lac=y&ct=y
pragma
no-cache
expires
0
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
GET
H3
200
rum
r.casalemedia.com/ Frame 4B69
43 B
762 B
69ms
42ms
Image
image/gif
104.18.26.193
Cloudflare
General
Full URL
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-INFyHEeroCOCSUKVjb8zA1-5feYthYa3Rm-AIg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=comuxDCZeRGFxjsKa195ysCo6iCzi5pZah8N32Fb1GfBeWJsZzyjE3EifwhqHono9zgP1Dftn7Z3%2BpX9gieZJZWniflJOHDYwWqTEHx9UTNCv%2BvIZidnmwSCtKclxLgk%2F9kd"}]}
cf-ray
a1eeece2e954b0a3-YYZ
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i
GET
H2
200
match
ad.360yield.com/ul_cb/ Frame 4B69
Redirect Chain
  • https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-zd0svUeroCOCSUKVjb8zA1-5feYaKWpjfu2y8A
  • https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-zd0svUeroCOCSUKVjb8zA1-5feYaKWpjfu2y8A
43 B
830 B
51ms
49ms
Image
image/gif
3.217.204.162
Amazon.com
General
Full URL
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-zd0svUeroCOCSUKVjb8zA1-5feYaKWpjfu2y8A
Protocol
H2
Server
3.217.204.162 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-217-204-162.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

access-control-allow-origin
*
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif

Redirect headers

access-control-allow-origin
*
location
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-zd0svUeroCOCSUKVjb8zA1-5feYaKWpjfu2y8A
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
GET
H2
200
362358.gif
idsync.rlcdn.com/ Frame 4B69
Redirect Chain
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w
  • https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=f539a137-8130-4240-8ed0-5ffc143770ff
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=88bfb23d-c3da-4acd-816c-02921b03f189%3A1784686397.5241072&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D88bfb23d-c3da-4acd-816c-02921b0...
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=970033204402624982&referrer=&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3D88bfb23d-c3da-4acd-816c-02921b0...
  • https://idsync.rlcdn.com/501709.gif?partner_uid=88bfb23d-c3da-4acd-816c-02921b03f189%3A1784686397.5241072&_=1784686398.5283608
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESENb7iBO2lNnHfmO3fRAr2gM&google_cver=1
42 B
319 B
52ms
50ms
Image
image/gif
35.244.154.8
Google LLC
General
Full URL
https://idsync.rlcdn.com/362358.gif?google_gid=CAESENb7iBO2lNnHfmO3fRAr2gM&google_cver=1
Protocol
H2
Server
35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
8.154.244.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

cache-control
no-cache, no-store
timing-allow-origin
*
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
42
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif

Redirect headers

cache-control
no-cache, must-revalidate
location
https://idsync.rlcdn.com/362358.gif?google_gid=CAESENb7iBO2lNnHfmO3fRAr2gM&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
289
date
Wed, 22 Jul 2026 02:13:22 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
push
exchange.mediavine.com/usersync/ Frame 4B69
0
527 B
286ms
48ms
Image
text/plain
100.25.13.4
Amazon.com
General
Full URL
https://exchange.mediavine.com/usersync/push?partner=criteo&partnerId=k-WMf1mEeroCOCSUKVjb8zA1-5feb4JqVK3DVBhQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
100.25.13.4 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-25-13-4.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-length
0
date
Wed, 22 Jul 2026 02:13:18 GMT
vary
origin, access-control-request-method, access-control-request-headers
access-control-allow-credentials
true
GET
H2
200
c.gif
c.bing.com/ Frame 4B69
42 B
690 B
1144ms
32ms
Image
image/gif
150.171.28.10
Microsoft Corpora...
General
Full URL
https://c.bing.com/c.gif?Red3=CTOMS_pd&cbid=k-rzafV0eroCOCSUKVjb8zA1-5febzMlSXcwOCnQ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
150.171.28.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, no-cache, proxy-revalidate, no-store
pragma
no-cache
etag
"a72625a6f6d8dc1:0"
x-msedge-ref
Ref A: 74320A4EAC8C43B0B942DC5F3E4BE1CE Ref B: CHI261140502023 Ref C: 2026-07-22T02:13:19Z
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
42
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:19 GMT
content-type
image/gif
last-modified
Thu, 30 Apr 2026 23:11:17 GMT
x-powered-by
ASP.NET
GET
H2
200
1017
jadserve.postrelease.com/suid/ Frame 4B69
43 B
547 B
381ms
42ms
Image
image/gif
23.23.167.209
Amazon.com
General
Full URL
https://jadserve.postrelease.com/suid/1017?vk=k-8bAW80eroCOCSUKVjb8zA1-5feYSE8JcyQajvA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.23.167.209 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-23-23-167-209.compute-1.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
expires
Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin
*
content-length
43
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif
GET
H/1.1
200
OK
cookie-sync
sync.outbrain.com/ Frame 4B69
0
360 B
1887ms
31ms
Image
text/plain
70.42.32.63
Outbrain
General
Full URL
https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-4KW9L0eroCOCSUKVjb8zA1-5feaLcQdWYwqHdQ&initiator=partner
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
70.42.32.63 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache
content-length
0
date
Wed, 22 Jul 2026 02:13:20 GMT
x-traceid
3fcd587e81c2a7b67ecf5a12dea895ee
GET
H2
200
Pug
simage2.pubmatic.com/AdServer/ Frame 4B69
42 B
114 B
38ms
37ms
Image
image/gif
207.65.32.88
PubMatic
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.32.88 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif; charset=utf-8
server
nginx
GET

pixel_sync
trends.revcontent.com/cm/ Frame 4B69
0
0


GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/ Frame 4B69
42 B
1 KB
129ms
36ms
Image
image/gif
216.19.192.2
Magnite
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-8FIPI0eroCOCSUKVjb8zA1-5febKOAClLPtylg&expires=30
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.19.192.2 , United States, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
dbf1a3bf291cc252d6b00d854a883c02
Pragma
no-cache
content-length
42
Content-Type
image/gif
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame 4B69
43 B
587 B
1031ms
90ms
Image
image/gif
216.22.16.9
Leaseweb USA
General
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-i1W4VUeroCOCSUKVjb8zA1-5fea_kKP_6CuPYA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC - Leaseweb USA, Inc., US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:20 GMT
pragma
no-cache
content-type
image/gif
GET
H2
200
/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 4B69
0
389 B
1169ms
177ms
Image
text/plain
141.226.227.75
TABOOLA-AS Tabool...
General
Full URL
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-n63geEeroCOCSUKVjb8zA1-5febq9swIAWLnqQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.227.75 Tokyo, Japan, ASN200478 (TABOOLA-AS Taboola.com ltd, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-fastly-to-nlb-rtt
173911
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
server
nginx
access-control-allow-credentials
true
GET
H2
200
um
criteo-sync.teads.tv/ Frame 4B69
23 B
388 B
614ms
41ms
Image
image/gif
151.101.194.132
Fastly
General
Full URL
https://criteo-sync.teads.tv/um?eid=80&uid=k-0ISRjEeroCOCSUKVjb8zA1-5febYMcEWBwrb5g
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.132 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
pekko-http/1.1.0 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-user-geo
US-EAST-1
cache-control
max-age=0, no-cache, no-store
x-timer
S1784686401.340673,VS0,VE23
x-check-cacheable
NO
via
1.1 varnish
accept-ranges
bytes
x-cache
MISS
content-length
23
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
x-served-by
cache-yyz4545-YYZ
server
pekko-http/1.1.0
x-cache-hits
0
traffic-path
NVADC2, YYZ, USA
GET
H2
200
sync
criteo-partners.tremorhub.com/ Frame 4B69
43 B
398 B
667ms
44ms
Image
image/gif
34.237.134.39
Amazon.com
General
Full URL
https://criteo-partners.tremorhub.com/sync?UICR=k-k0vmVkeroCOCSUKVjb8zA1-5feY21DF-jUOl8Q
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.237.134.39 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-237-134-39.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
server
nginx
GET
H/1.1
200
OK
sync.htm
ade.clmbtech.com/uid/ Frame 4B69
68 B
411 B
1896ms
237ms
Image
image/jpeg
23.12.145.162
AKAMAI-ASN1 Akama...
General
Full URL
https://ade.clmbtech.com/uid/sync.htm?pid=13079&cuid=k-82JxBEeroCOCSUKVjb8zA1-5feYHXvFXytIxaQ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.12.145.162 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-12-145-162.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
Security Headers
Name Value
Strict-Transport-Security max-age=25920000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Strict-Transport-Security
max-age=25920000; includeSubdomains
Connection
keep-alive
X-Content-Type-Options
nosniff
Alt-Svc
h3=":443"; ma=93600
Content-Length
68
X-Xss-Protection
1; mode=block
Date
Wed, 22 Jul 2026 02:13:23 GMT
Content-Type
image/jpeg
X-Upstream
10.71.28.95:80
X-Frame-Options
sameorigin
GET
H2
200
xuid
eb2.3lift.com/ Frame 4B69
Redirect Chain
  • https://eb2.3lift.com/xuid?mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b
  • https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b&gdpr=0&cmp_cs=&us_privacy=
37 B
247 B
55ms
46ms
Image
image/gif
54.237.4.69
Amazon.com
General
Full URL
https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b&gdpr=0&cmp_cs=&us_privacy=
Protocol
H2
Server
54.237.4.69 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-237-4-69.compute-1.amazonaws.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
37
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif

Redirect headers

cache-control
no-cache, no-store, must-revalidate
location
/xuid?ld=1&mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b&gdpr=0&cmp_cs=&us_privacy=
content-length
0
date
Wed, 22 Jul 2026 02:13:22 GMT
GET
H2
200
RX-1b95fd8e-4332-417d-a7db-43e208598e25-005
sync.targeting.unrulymedia.com/csync/ Frame 4B69
Redirect Chain
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ?zcc=1&cb=1784686401988
  • https://sync.targeting.unrulymedia.com/csync/RX-1b95fd8e-4332-417d-a7db-43e208598e25-005
43 B
378 B
3746ms
61ms
Image
image/gif
69.194.240.13
RhythmOne
General
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-1b95fd8e-4332-417d-a7db-43e208598e25-005
Protocol
H2
Server
69.194.240.13 , United States, ASN26120 (RHYTHMONE - RhythmOne, LLC, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date
Wed, 22 Jul 2026 02:13:25 GMT
content-length
43

Redirect headers

expires
0
cache-control
no-store, no-cache, must-revalidate
location
https://sync.targeting.unrulymedia.com/csync/RX-1b95fd8e-4332-417d-a7db-43e208598e25-005
date
Wed, 22 Jul 2026 02:13:22 GMT
pragma
no-cache
content-type
text/html
GET
H2
200
sync
x.bidswitch.net/ Frame 8C6D
43 B
92 B
156ms
148ms
Image
image/gif
35.211.202.130
YOUTUBE Google Ir...
General
Full URL
https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.211.202.130 North Charleston, United States, ASN43515 (YOUTUBE Google Ireland Limited, IE),
Reverse DNS
130.202.211.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 8C6D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzb...
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
43 B
803 B
36ms
35ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-cache, must-revalidate
location
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
398
date
Wed, 22 Jul 2026 02:13:21 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame 8C6D
Redirect Chain
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
43 B
811 B
35ms
34ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
location
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
154.47.17.42; 154.47.17.42; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
b54cdbd0-dce4-42fd-a812-71f2aa2b377a
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:21 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H2
204
/
partner.mediawallahscript.com/ Frame 8C6D
Redirect Chain
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=15243275-ad18-4ec1-a16c-6e2b4f4...
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile...
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=898704791
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=vxsrv3i&ttd_tpi=1
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=10ca1bb6-95f7-4722-a1e9-cf79bafb892e&tag_format=img&tag_action=sync&cb=
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb63d3b0-8572-11f1-906f-d97bef1a9b9b
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_r...
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3D...
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=f6676a60-2746-4200-bb76-e20a5d99875a&tag_format=img&tag_action=sync
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=93
0
406 B
49ms
48ms
Image
text/plain
67.202.16.78
Amazon.com
General
Full URL
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=93
Protocol
H2
Server
67.202.16.78 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-67-202-16-78.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

expires
Sat, 26 Jul 1997 05:00:00 GMT
cache-control
private, no-cache, must-revalidate, no-store, max-age=0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date
Wed, 22 Jul 2026 02:13:30 GMT
server
nginx

Redirect headers

strict-transport-security
max-age=2592000; includeSubDomains
location
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=93
Content-Length
0
Date
Wed, 22 Jul 2026 02:13:30 GMT
Connection
keep-alive
Server
gunicorn
GET
H2
200
SPug
simage4.pubmatic.com/AdServer/ Frame 8C6D
0
158 B
47ms
39ms
Image
text/plain
8.28.7.84
PubMatic
General
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=167352&partnerUID=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:21 GMT
server
nginx
GET
H2
200
cksync.php
cs.media.net/ Frame 8C6D
43 B
411 B
64ms
54ms
Image
image/gif
35.227.244.76
Google LLC
General
Full URL
https://cs.media.net/cksync.php?cs=3&type=crt&ovsid=k-pypeLEeroCOCSUKVjb8zA1-5feYUNB0JF_UGKQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.76 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
76.244.227.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
alt-svc
h3=":443"; ma=2592000
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
vary
Accept-Encoding
GET
H2
200
qmap
sync.crwdcntrl.net/ Frame 8C6D
Redirect Chain
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=IiKspV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCRGg0eDVUMCUyQkNUSVNUZktNd04yRk0&gdpr=0&gdpr_consent=&lac=y
49 B
267 B
91ms
80ms
Image
image/gif
98.85.140.86
Amazon.com
General
Full URL
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=IiKspV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCRGg0eDVUMCUyQkNUSVNUZktNd04yRk0&gdpr=0&gdpr_consent=&lac=y
Protocol
H2
Server
98.85.140.86 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-98-85-140-86.compute-1.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
pragma
no-cache
expires
0
access-control-allow-origin
*
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
49
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
location
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=IiKspV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCRGg0eDVUMCUyQkNUSVNUZktNd04yRk0&gdpr=0&gdpr_consent=&lac=y
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
server
Kestrel
server-processing-duration-in-ticks
1061629
GET
H3
200
rum
r.casalemedia.com/ Frame 8C6D
43 B
722 B
51ms
47ms
Image
image/gif
104.18.26.193
Cloudflare
General
Full URL
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-INFyHEeroCOCSUKVjb8zA1-5feYthYa3Rm-AIg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=736dAS2Pa0JKTF4M4RntN5VH5st3Rq16M5vAFZSvD3u2HCMqxWXhskoI2N9U1vIJUeB2ZZhzaOfcSL3gGJhbIwq8LTtcNZvz3Cr5x2B98CCp7hGcN9V0JDodjacIfdOdYsFC"}]}
cf-ray
a1eeecf9ee53b0a3-YYZ
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i
GET
H2
200
match
ad.360yield.com/ Frame 8C6D
43 B
933 B
62ms
55ms
Image
image/gif
3.217.204.162
Amazon.com
General
Full URL
https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-zd0svUeroCOCSUKVjb8zA1-5feYaKWpjfu2y8A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.217.204.162 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-217-204-162.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
GET
H/1.1
200
OK
52164
i6.liadm.com/s/ Frame 8C6D
Redirect Chain
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w
  • https://x.bidswitch.net/sync?ssp=liveintent&user_id=f539a137-8130-4240-8ed0-5ffc143770ff
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=liveintent&bsw_param=5c7324c3-bfde-42fe-9aab-48b387228531&google_hm=NWM3MzI0YzMtYmZkZS00MmZlLTlhYWItNDhiMzg3MjI4N...
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEC0e9gyBpid3Sflz1Hc9MOo&google_cver=1&ssp=liveintent&bsw_param=5c7324c3-bfde-42fe-9aab-48b387228531&gdpr_consent=&gdpr=
  • https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=5c7324c3-bfde-42fe-9aab-48b387228531
  • https://i6.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=5c7324c3-bfde-42fe-9aab-48b387228531
43 B
302 B
7699ms
37ms
Image
image/gif
100.60.151.254
Amazon.com
General
Full URL
https://i6.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=5c7324c3-bfde-42fe-9aab-48b387228531
Protocol
HTTP/1.1
Server
100.60.151.254 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-60-151-254.compute-1.amazonaws.com
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
Cache-Control
no-store
trace-id
65d19dbffbdc3661
Request-Time
0
Connection
keep-alive
Content-Length
43
Date
Wed, 22 Jul 2026 02:13:29 GMT
Content-Type
image/gif

Redirect headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
Location
https://i6.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=5c7324c3-bfde-42fe-9aab-48b387228531
Content-Length
0
Date
Wed, 22 Jul 2026 02:13:22 GMT
trace-id
a5242c5d6b24ab52
Request-Time
2
Connection
keep-alive
GET
H2
200
push
exchange.mediavine.com/usersync/ Frame 8C6D
0
526 B
51ms
47ms
Image
text/plain
100.25.13.4
Amazon.com
General
Full URL
https://exchange.mediavine.com/usersync/push?partner=criteo&partnerId=k-WMf1mEeroCOCSUKVjb8zA1-5feb4JqVK3DVBhQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
100.25.13.4 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-25-13-4.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
vary
origin, access-control-request-method, access-control-request-headers
access-control-allow-credentials
true
GET
H2
200
c.gif
c.bing.com/ Frame 8C6D
42 B
176 B
34ms
30ms
Image
image/gif
150.171.28.10
Microsoft Corpora...
General
Full URL
https://c.bing.com/c.gif?Red3=CTOMS_pd&cbid=k-rzafV0eroCOCSUKVjb8zA1-5febzMlSXcwOCnQ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
150.171.28.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, no-cache, proxy-revalidate, no-store
pragma
no-cache
etag
"a72625a6f6d8dc1:0"
x-msedge-ref
Ref A: 069DF8F09A5E49D5A80A3DFD6133C8AC Ref B: CHI261140502023 Ref C: 2026-07-22T02:13:21Z
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
42
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
last-modified
Thu, 30 Apr 2026 23:11:17 GMT
x-powered-by
ASP.NET
GET
H2
200
1017
jadserve.postrelease.com/suid/ Frame 8C6D
43 B
642 B
47ms
44ms
Image
image/gif
23.23.167.209
Amazon.com
General
Full URL
https://jadserve.postrelease.com/suid/1017?vk=k-8bAW80eroCOCSUKVjb8zA1-5feYSE8JcyQajvA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.23.167.209 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-23-23-167-209.compute-1.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
expires
Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin
*
content-length
43
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
GET
H/1.1
200
OK
cookie-sync
sync.outbrain.com/ Frame 8C6D
0
360 B
38ms
36ms
Image
text/plain
70.42.32.63
Outbrain
General
Full URL
https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-4KW9L0eroCOCSUKVjb8zA1-5feaLcQdWYwqHdQ&initiator=partner
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
70.42.32.63 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
x-traceid
331bdce4593ed7de543cf477cd475358
GET
H2
200
Pug
simage2.pubmatic.com/AdServer/ Frame 8C6D
42 B
96 B
45ms
43ms
Image
image/gif
207.65.32.88
PubMatic
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.32.88 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif; charset=utf-8
server
nginx
GET

pixel_sync
trends.revcontent.com/cm/ Frame 8C6D
0
0


GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/ Frame 8C6D
42 B
1 KB
39ms
37ms
Image
image/gif
216.19.192.2
Magnite
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-8FIPI0eroCOCSUKVjb8zA1-5febKOAClLPtylg&expires=30
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.19.192.2 , United States, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
dbf1a3bf291cc252d6b00d854a883c02
Pragma
no-cache
content-length
42
Content-Type
image/gif
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame 8C6D
43 B
351 B
51ms
39ms
Image
image/gif
216.22.16.9
Leaseweb USA
General
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-i1W4VUeroCOCSUKVjb8zA1-5fea_kKP_6CuPYA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC - Leaseweb USA, Inc., US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:20 GMT
pragma
no-cache
content-type
image/gif
GET
H2
200
/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 8C6D
0
388 B
345ms
176ms
Image
text/plain
141.226.227.75
TABOOLA-AS Tabool...
General
Full URL
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-n63geEeroCOCSUKVjb8zA1-5febq9swIAWLnqQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.227.75 Tokyo, Japan, ASN200478 (TABOOLA-AS Taboola.com ltd, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-fastly-to-nlb-rtt
173899
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
server
nginx
access-control-allow-credentials
true
GET
H2
200
um
criteo-sync.teads.tv/ Frame 8C6D
23 B
83 B
47ms
35ms
Image
image/gif
151.101.194.132
Fastly
General
Full URL
https://criteo-sync.teads.tv/um?eid=80&uid=k-0ISRjEeroCOCSUKVjb8zA1-5febYMcEWBwrb5g
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.132 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
pekko-http/1.1.0 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-user-geo
US-EAST-1
cache-control
max-age=0, no-cache, no-store
x-timer
S1784686402.638100,VS0,VE23
x-check-cacheable
NO
via
1.1 varnish
accept-ranges
bytes
x-cache
MISS
content-length
23
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
x-served-by
cache-yyz4545-YYZ
server
pekko-http/1.1.0
x-cache-hits
0
traffic-path
NVADC2, YYZ, USA
GET
H2
200
sync
criteo-partners.tremorhub.com/ Frame 8C6D
43 B
396 B
62ms
42ms
Image
image/gif
34.237.134.39
Amazon.com
General
Full URL
https://criteo-partners.tremorhub.com/sync?UICR=k-k0vmVkeroCOCSUKVjb8zA1-5feY21DF-jUOl8Q
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.237.134.39 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-237-134-39.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
server
nginx
GET
H/1.1
200
OK
sync.htm
ade.clmbtech.com/uid/ Frame 8C6D
68 B
411 B
2069ms
238ms
Image
image/jpeg
23.12.145.162
AKAMAI-ASN1 Akama...
General
Full URL
https://ade.clmbtech.com/uid/sync.htm?pid=13079&cuid=k-82JxBEeroCOCSUKVjb8zA1-5feYHXvFXytIxaQ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.12.145.162 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-12-145-162.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
Security Headers
Name Value
Strict-Transport-Security max-age=25920000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Strict-Transport-Security
max-age=25920000; includeSubdomains
Connection
keep-alive
X-Content-Type-Options
nosniff
Alt-Svc
h3=":443"; ma=93600
Content-Length
68
X-Xss-Protection
1; mode=block
Date
Wed, 22 Jul 2026 02:13:23 GMT
Content-Type
image/jpeg
X-Upstream
10.71.28.95:80
X-Frame-Options
sameorigin
GET
H2
200
xuid
eb2.3lift.com/ Frame 8C6D
Redirect Chain
  • https://eb2.3lift.com/xuid?mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b
  • https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b&gdpr=0&cmp_cs=&us_privacy=
37 B
247 B
53ms
49ms
Image
image/gif
54.237.4.69
Amazon.com
General
Full URL
https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b&gdpr=0&cmp_cs=&us_privacy=
Protocol
H2
Server
54.237.4.69 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-237-4-69.compute-1.amazonaws.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
37
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif

Redirect headers

cache-control
no-cache, no-store, must-revalidate
location
/xuid?ld=1&mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b&gdpr=0&cmp_cs=&us_privacy=
content-length
0
date
Wed, 22 Jul 2026 02:13:22 GMT
GET
H2
200
RX-431cf1de-8952-4768-bb0f-768478c0a626-005
sync.targeting.unrulymedia.com/csync/ Frame 8C6D
Redirect Chain
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ?zcc=1&cb=1784686402026
  • https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
43 B
377 B
3707ms
61ms
Image
image/gif
69.194.240.13
RhythmOne
General
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
Protocol
H2
Server
69.194.240.13 , United States, ASN26120 (RHYTHMONE - RhythmOne, LLC, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date
Wed, 22 Jul 2026 02:13:25 GMT
content-length
43

Redirect headers

expires
0
cache-control
no-store, no-cache, must-revalidate
location
https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
date
Wed, 22 Jul 2026 02:13:22 GMT
pragma
no-cache
content-type
text/html
GET
H2
200
sync
x.bidswitch.net/ Frame 431E
43 B
92 B
218ms
154ms
Image
image/gif
35.211.202.130
YOUTUBE Google Ir...
General
Full URL
https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.211.202.130 North Charleston, United States, ASN43515 (YOUTUBE Google Ireland Limited, IE),
Reverse DNS
130.202.211.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 431E
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzb...
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
43 B
808 B
46ms
45ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:20 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-cache, must-revalidate
location
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
398
date
Wed, 22 Jul 2026 02:13:21 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame 431E
Redirect Chain
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
43 B
808 B
45ms
44ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
location
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
154.47.17.42; 154.47.17.42; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
8cba74a2-c020-40ff-944a-7838c9878053
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:21 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H2
204
/
partner.mediawallahscript.com/ Frame 431E
Redirect Chain
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=eaaf9c63-87e8-444d-9bf2-e53e5f2...
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile...
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=474250927
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=vxsrv3i&ttd_tpi=1
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=7e81865b-5609-4081-ac6d-6aa472eb1942&tag_format=img&tag_action=sync&cb=
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb7e1270-8572-11f1-aea3-d335cdb6ce5b
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_r...
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3D...
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=3c956a60-2746-4c00-b354-e6273e36baed&tag_format=img&tag_action=sync
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=68
0
406 B
49ms
46ms
Image
text/plain
67.202.16.78
Amazon.com
General
Full URL
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=68
Protocol
H2
Server
67.202.16.78 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-67-202-16-78.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

expires
Sat, 26 Jul 1997 05:00:00 GMT
cache-control
private, no-cache, must-revalidate, no-store, max-age=0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date
Wed, 22 Jul 2026 02:13:30 GMT
server
nginx

Redirect headers

strict-transport-security
max-age=2592000; includeSubDomains
location
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=68
Content-Length
0
Date
Wed, 22 Jul 2026 02:13:30 GMT
Connection
keep-alive
Server
gunicorn
GET
H2
200
SPug
simage4.pubmatic.com/AdServer/ Frame 431E
0
49 B
36ms
34ms
Image
text/plain
8.28.7.84
PubMatic
General
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=167352&partnerUID=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:21 GMT
server
nginx
GET
H2
200
cksync.php
cs.media.net/ Frame 431E
43 B
393 B
55ms
53ms
Image
image/gif
35.227.244.76
Google LLC
General
Full URL
https://cs.media.net/cksync.php?cs=3&type=crt&ovsid=k-pypeLEeroCOCSUKVjb8zA1-5feYUNB0JF_UGKQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.76 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
76.244.227.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
vary
Accept-Encoding
GET
H2
200
qmap
sync.crwdcntrl.net/ Frame 431E
Redirect Chain
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=TnMAY19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVEYXhHY1ViaGlJSUU4JTJGaiUyQmhROHAxYQ&gdpr=0&gdpr_consent=&lac=y
49 B
267 B
67ms
65ms
Image
image/gif
98.85.140.86
Amazon.com
General
Full URL
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=TnMAY19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVEYXhHY1ViaGlJSUU4JTJGaiUyQmhROHAxYQ&gdpr=0&gdpr_consent=&lac=y
Protocol
H2
Server
98.85.140.86 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-98-85-140-86.compute-1.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
pragma
no-cache
expires
0
access-control-allow-origin
*
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
49
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
location
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=TnMAY19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVEYXhHY1ViaGlJSUU4JTJGaiUyQmhROHAxYQ&gdpr=0&gdpr_consent=&lac=y
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
server
Kestrel
server-processing-duration-in-ticks
1276622
GET
H3
200
rum
r.casalemedia.com/ Frame 431E
43 B
731 B
40ms
38ms
Image
image/gif
104.18.26.193
Cloudflare
General
Full URL
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-INFyHEeroCOCSUKVjb8zA1-5feYthYa3Rm-AIg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=1DaREMWbEWD%2B9hQEtyhoMtTdDPx0vUdLu%2FIs5qzHidAuhIFshfMJlZVtlvAb1%2FKC978NE631ySroG72U%2BlRsIku%2FHjSW0%2Bwuuy%2FoY1F29Lsbo6LGeD6eaLRcOJqx0BYCS3pF"}]}
cf-ray
a1eeecfa7f2db0a3-YYZ
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i
GET
H2
200
match
ad.360yield.com/ Frame 431E
43 B
934 B
53ms
51ms
Image
image/gif
3.217.204.162
Amazon.com
General
Full URL
https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-zd0svUeroCOCSUKVjb8zA1-5feYaKWpjfu2y8A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.217.204.162 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-217-204-162.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
GET

/
b1sync.zemanta.com/usersync/liveintent/ Frame 431E
Redirect Chain
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w
  • https://b1sync.zemanta.com/usersync/liveintent/?cb=//i.liadm.com/s/35004?bidder_id%3D98254%26bidder_uuid%3D__ZUID__
0
0


GET
H2
200
push
exchange.mediavine.com/usersync/ Frame 431E
0
526 B
53ms
43ms
Image
text/plain
100.25.13.4
Amazon.com
General
Full URL
https://exchange.mediavine.com/usersync/push?partner=criteo&partnerId=k-WMf1mEeroCOCSUKVjb8zA1-5feb4JqVK3DVBhQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
100.25.13.4 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-25-13-4.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
vary
origin, access-control-request-method, access-control-request-headers
access-control-allow-credentials
true
GET
H2
200
c.gif
c.bing.com/ Frame 431E
42 B
177 B
41ms
32ms
Image
image/gif
150.171.28.10
Microsoft Corpora...
General
Full URL
https://c.bing.com/c.gif?Red3=CTOMS_pd&cbid=k-rzafV0eroCOCSUKVjb8zA1-5febzMlSXcwOCnQ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
150.171.28.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, no-cache, proxy-revalidate, no-store
pragma
no-cache
etag
"a72625a6f6d8dc1:0"
x-msedge-ref
Ref A: DB54E1BBB322498FBF17FC72CD91C395 Ref B: CHI261140502023 Ref C: 2026-07-22T02:13:21Z
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
42
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
last-modified
Thu, 30 Apr 2026 23:11:17 GMT
x-powered-by
ASP.NET
GET
H2
200
1017
jadserve.postrelease.com/suid/ Frame 431E
43 B
322 B
52ms
43ms
Image
image/gif
23.23.167.209
Amazon.com
General
Full URL
https://jadserve.postrelease.com/suid/1017?vk=k-8bAW80eroCOCSUKVjb8zA1-5feYSE8JcyQajvA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.23.167.209 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-23-23-167-209.compute-1.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
expires
Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin
*
content-length
43
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
GET
H/1.1
200
OK
cookie-sync
sync.outbrain.com/ Frame 431E
0
360 B
34ms
32ms
Image
text/plain
70.42.32.63
Outbrain
General
Full URL
https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-4KW9L0eroCOCSUKVjb8zA1-5feaLcQdWYwqHdQ&initiator=partner
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
70.42.32.63 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache
content-length
0
date
Wed, 22 Jul 2026 02:13:22 GMT
x-traceid
51a74c37f78ef90e3126245fa2752c3e
GET
H2
200
Pug
simage2.pubmatic.com/AdServer/ Frame 431E
42 B
96 B
39ms
38ms
Image
image/gif
207.65.32.88
PubMatic
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.32.88 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif; charset=utf-8
server
nginx
GET

pixel_sync
trends.revcontent.com/cm/ Frame 431E
0
0


GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/ Frame 431E
42 B
1 KB
38ms
36ms
Image
image/gif
216.19.192.2
Magnite
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-8FIPI0eroCOCSUKVjb8zA1-5febKOAClLPtylg&expires=30
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.19.192.2 , United States, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
dbf1a3bf291cc252d6b00d854a883c02
Pragma
no-cache
content-length
42
Content-Type
image/gif
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame 431E
43 B
351 B
53ms
49ms
Image
image/gif
216.22.16.9
Leaseweb USA
General
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-i1W4VUeroCOCSUKVjb8zA1-5fea_kKP_6CuPYA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC - Leaseweb USA, Inc., US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:21 GMT
pragma
no-cache
content-type
image/gif
GET
H2
200
/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 431E
0
388 B
183ms
178ms
Image
text/plain
141.226.227.75
TABOOLA-AS Tabool...
General
Full URL
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-n63geEeroCOCSUKVjb8zA1-5febq9swIAWLnqQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.227.75 Tokyo, Japan, ASN200478 (TABOOLA-AS Taboola.com ltd, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-fastly-to-nlb-rtt
179477
content-length
0
date
Wed, 22 Jul 2026 02:13:22 GMT
server
nginx
access-control-allow-credentials
true
GET
H2
200
um
criteo-sync.teads.tv/ Frame 431E
23 B
106 B
45ms
41ms
Image
image/gif
151.101.194.132
Fastly
General
Full URL
https://criteo-sync.teads.tv/um?eid=80&uid=k-0ISRjEeroCOCSUKVjb8zA1-5febYMcEWBwrb5g
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.132 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
pekko-http/1.1.0 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-user-geo
US-EAST-1
cache-control
max-age=0, no-cache, no-store
x-timer
S1784686402.466844,VS0,VE23
x-check-cacheable
NO
via
1.1 varnish
accept-ranges
bytes
x-cache
MISS
content-length
23
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
x-served-by
cache-yyz4545-YYZ
server
pekko-http/1.1.0
x-cache-hits
0
traffic-path
NVADC2, YYZ, USA
GET
H2
200
sync
criteo-partners.tremorhub.com/ Frame 431E
43 B
291 B
52ms
47ms
Image
image/gif
34.237.134.39
Amazon.com
General
Full URL
https://criteo-partners.tremorhub.com/sync?UICR=k-k0vmVkeroCOCSUKVjb8zA1-5feY21DF-jUOl8Q
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.237.134.39 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-237-134-39.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
server
nginx
GET
H/1.1
200
OK
sync.htm
ade.clmbtech.com/uid/ Frame 431E
68 B
411 B
1750ms
236ms
Image
image/jpeg
23.12.145.162
AKAMAI-ASN1 Akama...
General
Full URL
https://ade.clmbtech.com/uid/sync.htm?pid=13079&cuid=k-82JxBEeroCOCSUKVjb8zA1-5feYHXvFXytIxaQ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.12.145.162 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-12-145-162.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
Security Headers
Name Value
Strict-Transport-Security max-age=25920000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Strict-Transport-Security
max-age=25920000; includeSubdomains
Connection
keep-alive
X-Content-Type-Options
nosniff
Alt-Svc
h3=":443"; ma=93600
Content-Length
68
X-Xss-Protection
1; mode=block
Date
Wed, 22 Jul 2026 02:13:24 GMT
Content-Type
image/jpeg
X-Upstream
10.71.28.93:80
X-Frame-Options
sameorigin
GET
H2
200
xuid
eb2.3lift.com/ Frame 431E
37 B
247 B
85ms
43ms
Image
image/gif
54.237.4.69
Amazon.com
General
Full URL
https://eb2.3lift.com/xuid?mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.237.4.69 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-237-4-69.compute-1.amazonaws.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
37
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
GET
H2
200
RX-431cf1de-8952-4768-bb0f-768478c0a626-005
sync.targeting.unrulymedia.com/csync/ Frame 431E
Redirect Chain
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ
  • https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
43 B
377 B
3149ms
34ms
Image
image/gif
69.194.240.13
RhythmOne
General
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
Protocol
H2
Server
69.194.240.13 , United States, ASN26120 (RHYTHMONE - RhythmOne, LLC, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date
Wed, 22 Jul 2026 02:13:25 GMT
content-length
43

Redirect headers

expires
0
cache-control
no-store, no-cache, must-revalidate
location
https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
date
Wed, 22 Jul 2026 02:13:22 GMT
pragma
no-cache
content-type
text/html
GET
H2
200
sync
x.bidswitch.net/ Frame F330
43 B
92 B
163ms
154ms
Image
image/gif
35.211.202.130
YOUTUBE Google Ir...
General
Full URL
https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.211.202.130 North Charleston, United States, ASN43515 (YOUTUBE Google Ireland Limited, IE),
Reverse DNS
130.202.211.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame F330
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzb...
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
43 B
800 B
52ms
50ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-cache, must-revalidate
location
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
398
date
Wed, 22 Jul 2026 02:13:22 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame F330
Redirect Chain
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
43 B
808 B
51ms
50ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
location
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
154.47.17.42; 154.47.17.42; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
c57cfca3-58cf-48ca-b791-5c42730f2e69
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:22 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H2
204
/
partner.mediawallahscript.com/ Frame F330
Redirect Chain
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=243e7f8e-3496-4ca6-9571-cd36f0f...
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile...
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=354664970
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=vxsrv3i&ttd_tpi=1
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=7e81865b-5609-4081-ac6d-6aa472eb1942&tag_format=img&tag_action=sync&cb=
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb8df0f0-8572-11f1-a3f7-0bef8b7b55cd
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_r...
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3D...
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=89086a60-2746-4100-8399-970d0fadd8ef&tag_format=img&tag_action=sync
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=84
0
406 B
57ms
51ms
Image
text/plain
67.202.16.78
Amazon.com
General
Full URL
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=84
Protocol
H2
Server
67.202.16.78 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-67-202-16-78.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

expires
Sat, 26 Jul 1997 05:00:00 GMT
cache-control
private, no-cache, must-revalidate, no-store, max-age=0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date
Wed, 22 Jul 2026 02:13:30 GMT
server
nginx

Redirect headers

strict-transport-security
max-age=2592000; includeSubDomains
location
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=84
Content-Length
0
Date
Wed, 22 Jul 2026 02:13:30 GMT
Connection
keep-alive
Server
gunicorn
GET
H2
200
SPug
simage4.pubmatic.com/AdServer/ Frame F330
0
129 B
43ms
34ms
Image
text/plain
8.28.7.84
PubMatic
General
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=167352&partnerUID=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:22 GMT
server
nginx
GET
H2
200
cksync.php
cs.media.net/ Frame F330
43 B
393 B
67ms
57ms
Image
image/gif
35.227.244.76
Google LLC
General
Full URL
https://cs.media.net/cksync.php?cs=3&type=crt&ovsid=k-pypeLEeroCOCSUKVjb8zA1-5feYUNB0JF_UGKQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.76 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
76.244.227.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
vary
Accept-Encoding
GET
H2
200
qmap
sync.crwdcntrl.net/ Frame F330
Redirect Chain
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=egLyTl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCU3phQmVRWTJ2VE83QXNnN1Rjc2o2&gdpr=0&gdpr_consent=&lac=y
49 B
267 B
73ms
72ms
Image
image/gif
98.85.140.86
Amazon.com
General
Full URL
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=egLyTl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCU3phQmVRWTJ2VE83QXNnN1Rjc2o2&gdpr=0&gdpr_consent=&lac=y
Protocol
H2
Server
98.85.140.86 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-98-85-140-86.compute-1.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
pragma
no-cache
expires
0
access-control-allow-origin
*
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
49
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
location
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=egLyTl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCU3phQmVRWTJ2VE83QXNnN1Rjc2o2&gdpr=0&gdpr_consent=&lac=y
content-length
0
date
Wed, 22 Jul 2026 02:13:22 GMT
server
Kestrel
server-processing-duration-in-ticks
1004115
GET
H3
200
rum
r.casalemedia.com/ Frame F330
43 B
730 B
49ms
42ms
Image
image/gif
104.18.26.193
Cloudflare
General
Full URL
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-INFyHEeroCOCSUKVjb8zA1-5feYthYa3Rm-AIg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=eJXhf88z8oIjfTJgnvl9ajbVYYzBpkdP%2Bo3RZie1A0uvQ4V%2BQSWqz42A6%2BqX028%2B9Dck9YkaHATKzMUdJSNe9Yzl0e0O0F8SGN%2BAarJ98ns0vALkRPuvm3MkrNN7%2BmCYp3Ra"}]}
cf-ray
a1eeed00988db0a3-YYZ
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i
GET
H2
200
match
ad.360yield.com/ Frame F330
43 B
932 B
59ms
49ms
Image
image/gif
3.217.204.162
Amazon.com
General
Full URL
https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-zd0svUeroCOCSUKVjb8zA1-5feYaKWpjfu2y8A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.217.204.162 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-217-204-162.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
GET
H2
200
ibs:dpid=127444&dpuuid=f539a137-8130-4240-8ed0-5ffc143770ff
dpm.demdex.net/ Frame F330
Redirect Chain
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w
  • https://dpm.demdex.net/ibs:dpid=127444&dpuuid=f539a137-8130-4240-8ed0-5ffc143770ff
42 B
715 B
58ms
57ms
Image
image/gif
54.172.43.65
Amazon.com
General
Full URL
https://dpm.demdex.net/ibs:dpid=127444&dpuuid=f539a137-8130-4240-8ed0-5ffc143770ff
Protocol
H2
Server
54.172.43.65 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-172-43-65.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs
dcs-prod-va6-2-v088-0365eff97.edge-va6.demdex.com 2 ms
content-encoding
gzip
pragma
no-cache
x-content-type-options
nosniff
x-tid
1uPkJVmwS2o=
expires
Thu, 01 Jan 1970 00:00:00 UTC
content-length
59
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif

Redirect headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
Location
https://dpm.demdex.net/ibs:dpid=127444&dpuuid=f539a137-8130-4240-8ed0-5ffc143770ff
Content-Length
0
Date
Wed, 22 Jul 2026 02:13:22 GMT
trace-id
36bdc47d58a22cba
Request-Time
2
Connection
keep-alive
GET
H2
200
push
exchange.mediavine.com/usersync/ Frame F330
0
526 B
51ms
47ms
Image
text/plain
100.25.13.4
Amazon.com
General
Full URL
https://exchange.mediavine.com/usersync/push?partner=criteo&partnerId=k-WMf1mEeroCOCSUKVjb8zA1-5feb4JqVK3DVBhQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
100.25.13.4 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-25-13-4.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-length
0
date
Wed, 22 Jul 2026 02:13:22 GMT
vary
origin, access-control-request-method, access-control-request-headers
access-control-allow-credentials
true
GET
H2
200
c.gif
c.bing.com/ Frame F330
42 B
177 B
32ms
29ms
Image
image/gif
150.171.28.10
Microsoft Corpora...
General
Full URL
https://c.bing.com/c.gif?Red3=CTOMS_pd&cbid=k-rzafV0eroCOCSUKVjb8zA1-5febzMlSXcwOCnQ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
150.171.28.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, no-cache, proxy-revalidate, no-store
pragma
no-cache
etag
"a72625a6f6d8dc1:0"
x-msedge-ref
Ref A: 65B109F53ADF47F1A449EF61D777C281 Ref B: CHI261140502023 Ref C: 2026-07-22T02:13:22Z
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
42
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
last-modified
Thu, 30 Apr 2026 23:11:17 GMT
x-powered-by
ASP.NET
GET
H2
200
1017
jadserve.postrelease.com/suid/ Frame F330
43 B
322 B
49ms
45ms
Image
image/gif
23.23.167.209
Amazon.com
General
Full URL
https://jadserve.postrelease.com/suid/1017?vk=k-8bAW80eroCOCSUKVjb8zA1-5feYSE8JcyQajvA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.23.167.209 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-23-23-167-209.compute-1.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
expires
Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin
*
content-length
43
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
GET
H/1.1
200
OK
cookie-sync
sync.outbrain.com/ Frame F330
0
360 B
49ms
32ms
Image
text/plain
70.42.32.63
Outbrain
General
Full URL
https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-4KW9L0eroCOCSUKVjb8zA1-5feaLcQdWYwqHdQ&initiator=partner
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
70.42.32.63 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache
content-length
0
date
Wed, 22 Jul 2026 02:13:22 GMT
x-traceid
3d5a5b9ce00f9b15049ab4ffde50df2d
GET
H2
200
Pug
simage2.pubmatic.com/AdServer/ Frame F330
42 B
96 B
59ms
36ms
Image
image/gif
207.65.32.88
PubMatic
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.32.88 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif; charset=utf-8
server
nginx
GET

pixel_sync
trends.revcontent.com/cm/ Frame F330
0
0


GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/ Frame F330
42 B
1 KB
38ms
37ms
Image
image/gif
216.19.192.2
Magnite
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-8FIPI0eroCOCSUKVjb8zA1-5febKOAClLPtylg&expires=30
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.19.192.2 , United States, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
dbf1a3bf291cc252d6b00d854a883c02
Pragma
no-cache
content-length
42
Content-Type
image/gif
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame F330
43 B
351 B
76ms
74ms
Image
image/gif
216.22.16.9
Leaseweb USA
General
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-i1W4VUeroCOCSUKVjb8zA1-5fea_kKP_6CuPYA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC - Leaseweb USA, Inc., US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:22 GMT
pragma
no-cache
content-type
image/gif
GET
H2
200
/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame F330
0
388 B
178ms
176ms
Image
text/plain
141.226.227.75
TABOOLA-AS Tabool...
General
Full URL
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-n63geEeroCOCSUKVjb8zA1-5febq9swIAWLnqQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.227.75 Tokyo, Japan, ASN200478 (TABOOLA-AS Taboola.com ltd, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-fastly-to-nlb-rtt
179170
content-length
0
date
Wed, 22 Jul 2026 02:13:22 GMT
server
nginx
access-control-allow-credentials
true
GET
H2
200
um
criteo-sync.teads.tv/ Frame F330
23 B
82 B
76ms
75ms
Image
image/gif
151.101.194.132
Fastly
General
Full URL
https://criteo-sync.teads.tv/um?eid=80&uid=k-0ISRjEeroCOCSUKVjb8zA1-5febYMcEWBwrb5g
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.132 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
pekko-http/1.1.0 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-user-geo
US-EAST-1
cache-control
max-age=0, no-cache, no-store
x-timer
S1784686403.808900,VS0,VE22
x-check-cacheable
NO
via
1.1 varnish
accept-ranges
bytes
x-cache
MISS
content-length
23
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
x-served-by
cache-yyz4545-YYZ
server
pekko-http/1.1.0
x-cache-hits
0
traffic-path
NVADC2, YYZ, USA
GET
H2
200
sync
criteo-partners.tremorhub.com/ Frame F330
43 B
291 B
61ms
60ms
Image
image/gif
34.237.134.39
Amazon.com
General
Full URL
https://criteo-partners.tremorhub.com/sync?UICR=k-k0vmVkeroCOCSUKVjb8zA1-5feY21DF-jUOl8Q
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.237.134.39 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-237-134-39.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
server
nginx
GET
H3
200
sync.htm
ade.clmbtech.com/uid/ Frame F330
68 B
89 B
1698ms
279ms
Image
image/jpeg
23.12.145.162
AKAMAI-ASN1 Akama...
General
Full URL
https://ade.clmbtech.com/uid/sync.htm?pid=13079&cuid=k-82JxBEeroCOCSUKVjb8zA1-5feYHXvFXytIxaQ
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
23.12.145.162 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-12-145-162.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
Security Headers
Name Value
Strict-Transport-Security max-age=25920000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=25920000; includeSubdomains
x-content-type-options
nosniff
quic-version
0x00000001
alt-svc
h3=":443"; ma=93600
content-length
68
x-xss-protection
1; mode=block
date
Wed, 22 Jul 2026 02:13:24 GMT
content-type
image/jpeg
x-upstream
10.71.28.96:80
x-frame-options
sameorigin
GET
H2
200
xuid
eb2.3lift.com/ Frame F330
37 B
247 B
70ms
66ms
Image
image/gif
54.237.4.69
Amazon.com
General
Full URL
https://eb2.3lift.com/xuid?mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.237.4.69 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-237-4-69.compute-1.amazonaws.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
37
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
GET
H2
200
RX-431cf1de-8952-4768-bb0f-768478c0a626-005
sync.targeting.unrulymedia.com/csync/ Frame F330
Redirect Chain
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ
  • https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
43 B
377 B
2954ms
34ms
Image
image/gif
69.194.240.13
RhythmOne
General
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
Protocol
H2
Server
69.194.240.13 , United States, ASN26120 (RHYTHMONE - RhythmOne, LLC, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date
Wed, 22 Jul 2026 02:13:25 GMT
content-length
43

Redirect headers

expires
0
cache-control
no-store, no-cache, must-revalidate
location
https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
date
Wed, 22 Jul 2026 02:13:22 GMT
pragma
no-cache
content-type
text/html
GET
H2
200
sync
x.bidswitch.net/ Frame 1C5E
43 B
92 B
168ms
164ms
Image
image/gif
35.211.202.130
YOUTUBE Google Ir...
General
Full URL
https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.211.202.130 North Charleston, United States, ASN43515 (YOUTUBE Google Ireland Limited, IE),
Reverse DNS
130.202.211.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 1C5E
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzb...
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
43 B
800 B
40ms
39ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-cache, must-revalidate
location
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
398
date
Wed, 22 Jul 2026 02:13:22 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame 1C5E
Redirect Chain
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
43 B
800 B
42ms
39ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
location
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
154.47.17.42; 154.47.17.42; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
8016167b-1740-41a0-ba96-18d7443e1d23
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:22 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H2
204
/
partner.mediawallahscript.com/ Frame 1C5E
Redirect Chain
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=b9c2c807-c537-4a97-96fe-7298a1b...
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile...
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=129089725
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=vxsrv3i&ttd_tpi=1
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=7e81865b-5609-4081-ac6d-6aa472eb1942&tag_format=img&tag_action=sync&cb=
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb9b5e70-8572-11f1-9363-a1ee2bd1f277
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_r...
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3D...
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=3c956a60-2746-4c00-b354-e6273e36baed&tag_format=img&tag_action=sync
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=21
0
406 B
59ms
52ms
Image
text/plain
67.202.16.78
Amazon.com
General
Full URL
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=21
Protocol
H2
Server
67.202.16.78 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-67-202-16-78.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

expires
Sat, 26 Jul 1997 05:00:00 GMT
cache-control
private, no-cache, must-revalidate, no-store, max-age=0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date
Wed, 22 Jul 2026 02:13:31 GMT
server
nginx

Redirect headers

strict-transport-security
max-age=2592000; includeSubDomains
location
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=21
Content-Length
0
Date
Wed, 22 Jul 2026 02:13:30 GMT
Connection
keep-alive
Server
gunicorn
GET
H2
200
SPug
simage4.pubmatic.com/AdServer/ Frame 1C5E
0
49 B
80ms
77ms
Image
text/plain
8.28.7.84
PubMatic
General
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=167352&partnerUID=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:22 GMT
server
nginx
GET
H2
200
cksync.php
cs.media.net/ Frame 1C5E
43 B
393 B
81ms
78ms
Image
image/gif
35.227.244.76
Google LLC
General
Full URL
https://cs.media.net/cksync.php?cs=3&type=crt&ovsid=k-pypeLEeroCOCSUKVjb8zA1-5feYUNB0JF_UGKQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.76 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
76.244.227.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
vary
Accept-Encoding
GET
H2
200
qmap
sync.crwdcntrl.net/ Frame 1C5E
Redirect Chain
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=2kP7EF9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBWU9XdVBidGVjVmhoV2VYTyUyQlUlMkJidg&gdpr=0&gdpr_consent=&lac=y
49 B
267 B
75ms
71ms
Image
image/gif
98.85.140.86
Amazon.com
General
Full URL
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=2kP7EF9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBWU9XdVBidGVjVmhoV2VYTyUyQlUlMkJidg&gdpr=0&gdpr_consent=&lac=y
Protocol
H2
Server
98.85.140.86 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-98-85-140-86.compute-1.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
pragma
no-cache
expires
0
access-control-allow-origin
*
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
49
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
location
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=2kP7EF9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBWU9XdVBidGVjVmhoV2VYTyUyQlUlMkJidg&gdpr=0&gdpr_consent=&lac=y
content-length
0
date
Wed, 22 Jul 2026 02:13:22 GMT
server
Kestrel
server-processing-duration-in-ticks
1146015
GET
H3
200
rum
r.casalemedia.com/ Frame 1C5E
43 B
727 B
77ms
75ms
Image
image/gif
104.18.26.193
Cloudflare
General
Full URL
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-INFyHEeroCOCSUKVjb8zA1-5feYthYa3Rm-AIg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JHuezvoCSb4G095%2F25CFR6AY%2FMSnRB%2BvYrpAYf9EXNEk13K2JxgSB5fpSR9tQ7CjqeibOKD7iH4n0b1IVfC29d3T4d4cwFh5re%2FexyR5NDjw7LP1GYJF1cS064GZpHirCoEp"}]}
cf-ray
a1eeed01c9fdb0a3-YYZ
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i
GET
H2
200
match
ad.360yield.com/ Frame 1C5E
43 B
933 B
78ms
74ms
Image
image/gif
3.217.204.162
Amazon.com
General
Full URL
https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-zd0svUeroCOCSUKVjb8zA1-5feYaKWpjfu2y8A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.217.204.162 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-217-204-162.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
GET
H2
200
check
pixel.tapad.com/idsync/ex/receive/ Frame 1C5E
Redirect Chain
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w
  • https://sync.srv.stackadapt.com/sync?nid=307
  • https://i.liadm.com/s/89249?bidder_id=246504&bidder_uuid=9FNJj6QeUdlKp0Ox6m71JpovESo
  • https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=968c7bfbc7b7d3007143abb9bc724330&k=zeta-data-cloud-ca-pixel-5753
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3181&partner_device_id=88bfb23d-c3da-4acd-816c-02921b03f189:1784686397.5241072
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3181&partner_device_id=88bfb23d-c3da-4acd-816c-02921b03f189:1784686397.5241072
95 B
426 B
59ms
55ms
Image
image/png
34.111.113.62
Google LLC
General
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3181&partner_device_id=88bfb23d-c3da-4acd-816c-02921b03f189:1784686397.5241072
Protocol
H2
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
95
date
Wed, 22 Jul 2026 02:13:24 GMT
content-type
image/png

Redirect headers

strict-transport-security
max-age=31536000
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3181&partner_device_id=88bfb23d-c3da-4acd-816c-02921b03f189:1784686397.5241072
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
0
date
Wed, 22 Jul 2026 02:13:24 GMT
GET
H2
200
push
exchange.mediavine.com/usersync/ Frame 1C5E
0
526 B
79ms
49ms
Image
text/plain
100.25.13.4
Amazon.com
General
Full URL
https://exchange.mediavine.com/usersync/push?partner=criteo&partnerId=k-WMf1mEeroCOCSUKVjb8zA1-5feb4JqVK3DVBhQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
100.25.13.4 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-25-13-4.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-length
0
date
Wed, 22 Jul 2026 02:13:22 GMT
vary
origin, access-control-request-method, access-control-request-headers
access-control-allow-credentials
true
GET
H2
200
c.gif
c.bing.com/ Frame 1C5E
42 B
178 B
55ms
26ms
Image
image/gif
150.171.28.10
Microsoft Corpora...
General
Full URL
https://c.bing.com/c.gif?Red3=CTOMS_pd&cbid=k-rzafV0eroCOCSUKVjb8zA1-5febzMlSXcwOCnQ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
150.171.28.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, no-cache, proxy-revalidate, no-store
pragma
no-cache
etag
"a72625a6f6d8dc1:0"
x-msedge-ref
Ref A: E2D89D5D7DC34CFA86EB709AF93E46B9 Ref B: CHI261140502023 Ref C: 2026-07-22T02:13:22Z
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
42
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
last-modified
Thu, 30 Apr 2026 23:11:17 GMT
x-powered-by
ASP.NET
GET
H2
200
1017
jadserve.postrelease.com/suid/ Frame 1C5E
43 B
322 B
64ms
36ms
Image
image/gif
23.23.167.209
Amazon.com
General
Full URL
https://jadserve.postrelease.com/suid/1017?vk=k-8bAW80eroCOCSUKVjb8zA1-5feYSE8JcyQajvA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.23.167.209 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-23-23-167-209.compute-1.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
expires
Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin
*
content-length
43
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
GET
H/1.1
200
OK
cookie-sync
sync.outbrain.com/ Frame 1C5E
0
360 B
37ms
33ms
Image
text/plain
70.42.32.63
Outbrain
General
Full URL
https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-4KW9L0eroCOCSUKVjb8zA1-5feaLcQdWYwqHdQ&initiator=partner
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
70.42.32.63 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache
content-length
0
date
Wed, 22 Jul 2026 02:13:23 GMT
x-traceid
291ef28d3af71d99d4f6354e534cd41a
GET
H2
200
Pug
simage2.pubmatic.com/AdServer/ Frame 1C5E
42 B
96 B
47ms
38ms
Image
image/gif
207.65.32.88
PubMatic
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.32.88 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif; charset=utf-8
server
nginx
GET

pixel_sync
trends.revcontent.com/cm/ Frame 1C5E
0
0


GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/ Frame 1C5E
42 B
1 KB
47ms
44ms
Image
image/gif
216.19.192.2
Magnite
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-8FIPI0eroCOCSUKVjb8zA1-5febKOAClLPtylg&expires=30
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.19.192.2 , United States, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
dbf1a3bf291cc252d6b00d854a883c02
Pragma
no-cache
content-length
42
Content-Type
image/gif
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame 1C5E
43 B
351 B
58ms
47ms
Image
image/gif
216.22.16.9
Leaseweb USA
General
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-i1W4VUeroCOCSUKVjb8zA1-5fea_kKP_6CuPYA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC - Leaseweb USA, Inc., US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:22 GMT
pragma
no-cache
content-type
image/gif
GET
H2
200
/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 1C5E
0
388 B
191ms
171ms
Image
text/plain
141.226.227.75
TABOOLA-AS Tabool...
General
Full URL
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-n63geEeroCOCSUKVjb8zA1-5febq9swIAWLnqQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.227.75 Tokyo, Japan, ASN200478 (TABOOLA-AS Taboola.com ltd, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-fastly-to-nlb-rtt
178522
content-length
0
date
Wed, 22 Jul 2026 02:13:23 GMT
server
nginx
access-control-allow-credentials
true
GET
H2
200
um
criteo-sync.teads.tv/ Frame 1C5E
23 B
106 B
50ms
36ms
Image
image/gif
151.101.194.132
Fastly
General
Full URL
https://criteo-sync.teads.tv/um?eid=80&uid=k-0ISRjEeroCOCSUKVjb8zA1-5febYMcEWBwrb5g
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.132 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
pekko-http/1.1.0 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-user-geo
US-EAST-1
cache-control
max-age=0, no-cache, no-store
x-timer
S1784686403.223385,VS0,VE22
x-check-cacheable
NO
via
1.1 varnish
accept-ranges
bytes
x-cache
MISS
content-length
23
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
x-served-by
cache-yyz4545-YYZ
server
pekko-http/1.1.0
x-cache-hits
0
traffic-path
NVADC2, YYZ, USA
GET
H2
200
sync
criteo-partners.tremorhub.com/ Frame 1C5E
43 B
292 B
67ms
46ms
Image
image/gif
34.237.134.39
Amazon.com
General
Full URL
https://criteo-partners.tremorhub.com/sync?UICR=k-k0vmVkeroCOCSUKVjb8zA1-5feY21DF-jUOl8Q
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.237.134.39 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-237-134-39.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
server
nginx
GET
H3
200
sync.htm
ade.clmbtech.com/uid/ Frame 1C5E
68 B
89 B
1630ms
309ms
Image
image/jpeg
23.12.145.162
AKAMAI-ASN1 Akama...
General
Full URL
https://ade.clmbtech.com/uid/sync.htm?pid=13079&cuid=k-82JxBEeroCOCSUKVjb8zA1-5feYHXvFXytIxaQ
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
23.12.145.162 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-12-145-162.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
Security Headers
Name Value
Strict-Transport-Security max-age=25920000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=25920000; includeSubdomains
x-content-type-options
nosniff
quic-version
0x00000001
alt-svc
h3=":443"; ma=93600
content-length
68
x-xss-protection
1; mode=block
date
Wed, 22 Jul 2026 02:13:24 GMT
content-type
image/jpeg
x-upstream
10.71.28.93:80
x-frame-options
sameorigin
GET
H2
200
xuid
eb2.3lift.com/ Frame 1C5E
37 B
248 B
56ms
43ms
Image
image/gif
54.237.4.69
Amazon.com
General
Full URL
https://eb2.3lift.com/xuid?mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.237.4.69 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-237-4-69.compute-1.amazonaws.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
37
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
GET
H2
200
RX-431cf1de-8952-4768-bb0f-768478c0a626-005
sync.targeting.unrulymedia.com/csync/ Frame 1C5E
Redirect Chain
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ
  • https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
43 B
377 B
2654ms
36ms
Image
image/gif
69.194.240.13
RhythmOne
General
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
Protocol
H2
Server
69.194.240.13 , United States, ASN26120 (RHYTHMONE - RhythmOne, LLC, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date
Wed, 22 Jul 2026 02:13:25 GMT
content-length
43

Redirect headers

expires
0
cache-control
no-store, no-cache, must-revalidate
location
https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
date
Wed, 22 Jul 2026 02:13:23 GMT
pragma
no-cache
content-type
text/html
GET
H2
200
sync
x.bidswitch.net/ Frame F31B
43 B
92 B
168ms
155ms
Image
image/gif
35.211.202.130
YOUTUBE Google Ir...
General
Full URL
https://x.bidswitch.net/sync?dsp_id=46&user_id=k-fwGMPEeroCOCSUKVjb8zA1-5feYgzsGGUQJ0Sw&expires=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.211.202.130 North Charleston, United States, ASN43515 (YOUTUBE Google Ireland Limited, IE),
Reverse DNS
130.202.211.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame F31B
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_cm&google_hm=ay1DVFVPY0Vlcm9DT0NTVUtWamI4ekExLTVmZVpfTHYzb...
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
43 B
800 B
53ms
40ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-cache, must-revalidate
location
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&google_gid=CAESEHoOieJ_mUim8Y8nZETMnp4&google_cver=1&google_ula=913071,0
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
398
date
Wed, 22 Jul 2026 02:13:23 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame F31B
Redirect Chain
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
43 B
797 B
49ms
38ms
Image
image/gif
74.119.117.57
Criteo Corp.
General
Full URL
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
Protocol
H2
Server
74.119.117.57 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
x-criteo-endpoint-version
none
pragma
no-cache
api-supported-versions
1.0
cross-origin-resource-policy
cross-origin
expires
Mon, 26 Jul 1997 05:00:00 GMT
x-criteo-endpoint-controller
CookieMatch
x-criteo-endpoint-action
CookieMatch
content-length
43
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
image/gif
server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
location
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=616405946471127822
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
154.47.17.42; 154.47.17.42; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
c1fdf1e6-cb89-4913-a585-0e8e9111bc94
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:23 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H2
204
/
partner.mediawallahscript.com/ Frame F31B
Redirect Chain
  • https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-CTUOcEeroCOCSUKVjb8zA1-5feZ_Lv3medJywg&custom=&tag_format=img&tag_action=sync&custom=&cb=2dc4f7f0-36e7-4b66-950c-a5709ad...
  • https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=616405946471127822&tag_format=img&tag_action=sync
  • https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=e98799a0-8572-11f1-b113-dfaa3451232d?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile...
  • https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=2a5f709bd66dacd324be0b5da191e7e6&tag_format=img&tag_action=sync&cb=783739093
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vxsrv3i&ttd_tpi=1
  • https://partner.mediawallahscript.com/?account_id=2027&partner_id=2051&uid=7e81865b-5609-4081-ac6d-6aa472eb1942&tag_format=img&tag_action=sync&cb=
  • https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/mwal?url=https://partner.mediawallahscript.com/?account_id%3D2006%26partner_id%3D2131%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://partner.mediawallahscript.com/?account_id=2006&partner_id=2131&custom=&tag_format=img&tag_action=sync&puid=eb9480a0-8572-11f1-906f-d97bef1a9b9b
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D1009%26partner_id%3Dc182f930%26uid%3D%24UID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync&sovrn_r...
  • https://partner.mediawallahscript.com/?account_id=1009&partner_id=c182f930&uid=NCpF0LZHAZ-HmWd_YGByZAVw&custom=&tag_format=img&tag_action=sync
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2030%26partner_id%3D2147%26uid%3D%23PM_USER_ID%26tag_format%3Dimg%26tag_action%3D...
  • https://partner.mediawallahscript.com/?account_id=2030&partner_id=2147&uid=78F3360B-B494-42EF-A045-0FFACEB7E57E&tag_format=img&tag_action=sync
  • https://sync.mathtag.com/sync/img?mt_exid=10103&redirect=https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=[MM_UUID]&tag_format=img&tag_action=sync
  • https://partner.mediawallahscript.com/?account_id=2036&partner_id=2149&uid=f6676a60-2746-4200-bb76-e20a5d99875a&tag_format=img&tag_action=sync
  • https://match.prod.bidr.io/cookie-sync/mediawallah?dif=1
  • https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=22
0
406 B
56ms
55ms
Image
text/plain
67.202.16.78
Amazon.com
General
Full URL
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=22
Protocol
H2
Server
67.202.16.78 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-67-202-16-78.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

expires
Sat, 26 Jul 1997 05:00:00 GMT
cache-control
private, no-cache, must-revalidate, no-store, max-age=0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date
Wed, 22 Jul 2026 02:13:30 GMT
server
nginx

Redirect headers

strict-transport-security
max-age=2592000; includeSubDomains
location
https://partner.mediawallahscript.com/?account_id=2034&partner_id=2079&uid=AAB0c07UwE4AAAA0artE0g&tag_format=img&tag_action=sync&cb=22
Content-Length
0
Date
Wed, 22 Jul 2026 02:13:30 GMT
Connection
keep-alive
Server
gunicorn
GET
H2
200
SPug
simage4.pubmatic.com/AdServer/ Frame F31B
0
129 B
47ms
34ms
Image
text/plain
8.28.7.84
PubMatic
General
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=167352&partnerUID=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:23 GMT
server
nginx
GET
H2
200
cksync.php
cs.media.net/ Frame F31B
43 B
393 B
71ms
52ms
Image
image/gif
35.227.244.76
Google LLC
General
Full URL
https://cs.media.net/cksync.php?cs=3&type=crt&ovsid=k-pypeLEeroCOCSUKVjb8zA1-5feYUNB0JF_UGKQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.76 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
76.244.227.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
vary
Accept-Encoding
GET
H2
200
qmap
sync.crwdcntrl.net/ Frame F31B
Redirect Chain
  • https://gum.criteo.com/sync?c=1037&r=1&a=1&gdpr=0&gdpr_consent=&u=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D16722%26tp%3DMDAG%26tpid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D%26lac%3Dy
  • https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=It3gM19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDRXdDb28zSE5jZER2d2IxNlRBVkR0&gdpr=0&gdpr_consent=&lac=y
49 B
267 B
65ms
58ms
Image
image/gif
98.85.140.86
Amazon.com
General
Full URL
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=It3gM19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDRXdDb28zSE5jZER2d2IxNlRBVkR0&gdpr=0&gdpr_consent=&lac=y
Protocol
H2
Server
98.85.140.86 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-98-85-140-86.compute-1.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
pragma
no-cache
expires
0
access-control-allow-origin
*
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
49
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
location
https://sync.crwdcntrl.net/qmap?c=16722&tp=MDAG&tpid=It3gM19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDRXdDb28zSE5jZER2d2IxNlRBVkR0&gdpr=0&gdpr_consent=&lac=y
content-length
0
date
Wed, 22 Jul 2026 02:13:22 GMT
server
Kestrel
server-processing-duration-in-ticks
1204127
GET
H3
200
rum
r.casalemedia.com/ Frame F31B
43 B
727 B
49ms
42ms
Image
image/gif
104.18.26.193
Cloudflare
General
Full URL
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-INFyHEeroCOCSUKVjb8zA1-5feYthYa3Rm-AIg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Of5zzyr2QwocryUtaAWezNoYXWmAEpXQ2unn8I2DBaA1PUkAcY%2BxORQXYgL8gybj1os%2FR0T5rD628kcVBWcmC3fDSXls6059VYzx%2BC%2Fc9Tj736FDNsGnCjHQ6G11hJQFVSMa"}]}
cf-ray
a1eeed042d57b0a3-YYZ
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i
GET
H2
200
match
ad.360yield.com/ Frame F31B
43 B
934 B
66ms
47ms
Image
image/gif
3.217.204.162
Amazon.com
General
Full URL
https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-zd0svUeroCOCSUKVjb8zA1-5feYaKWpjfu2y8A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.217.204.162 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-217-204-162.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
GET
H2
200
db_sync
px.ads.linkedin.com/ Frame F31B
Redirect Chain
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-69iGYkeroCOCSUKVjb8zA1-5fea192sIIzrw_w
  • https://px.ads.linkedin.com/db_sync?pid=16261&puuid=f539a137-8130-4240-8ed0-5ffc143770ff&rand=1784686403
  • https://px.ads.linkedin.com/db_sync?pid=16261&puuid=f539a137-8130-4240-8ed0-5ffc143770ff&rand=1784686403&expected_cookie=cfb0fa39-291c-476e-b645-97021b8d8ea2
0
62 B
121ms
120ms
Image
text/plain
172.64.146.215
Cloudflare
General
Full URL
https://px.ads.linkedin.com/db_sync?pid=16261&puuid=f539a137-8130-4240-8ed0-5ffc143770ff&rand=1784686403&expected_cookie=cfb0fa39-291c-476e-b645-97021b8d8ea2
Protocol
H2
Server
172.64.146.215 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

linkedin-action
1
x-li-pop
cf-prod-lor1-x
strict-transport-security
max-age=31536000
cf-cache-status
DYNAMIC
x-li-fabric
prod-lor1
x-content-type-options
nosniff
cf-ray
a1eeed09dd808eb6-YYZ
x-li-uuid
AAZXKa8oQVfQgJhCHk6mlg==
x-li-proto
http/2
alt-svc
h3=":443"; ma=86400
content-length
0
date
Wed, 22 Jul 2026 02:13:24 GMT
server
cloudflare

Redirect headers

linkedin-action
1
x-li-pop
cf-prod-lor1-x
strict-transport-security
max-age=31536000
location
/db_sync?pid=16261&puuid=f539a137-8130-4240-8ed0-5ffc143770ff&rand=1784686403&expected_cookie=cfb0fa39-291c-476e-b645-97021b8d8ea2
cf-cache-status
DYNAMIC
x-li-fabric
prod-lor1
x-content-type-options
nosniff
cf-ray
a1eeed08eae18eb6-YYZ
x-li-uuid
AAZXKa8mJEZwVtANLUUzpA==
x-li-proto
http/2
alt-svc
h3=":443"; ma=86400
content-length
0
date
Wed, 22 Jul 2026 02:13:24 GMT
server
cloudflare
GET
H2
200
push
exchange.mediavine.com/usersync/ Frame F31B
0
526 B
57ms
46ms
Image
text/plain
100.25.13.4
Amazon.com
General
Full URL
https://exchange.mediavine.com/usersync/push?partner=criteo&partnerId=k-WMf1mEeroCOCSUKVjb8zA1-5feb4JqVK3DVBhQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
100.25.13.4 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-25-13-4.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-length
0
date
Wed, 22 Jul 2026 02:13:23 GMT
vary
origin, access-control-request-method, access-control-request-headers
access-control-allow-credentials
true
GET
H2
200
c.gif
c.bing.com/ Frame F31B
42 B
177 B
43ms
34ms
Image
image/gif
150.171.28.10
Microsoft Corpora...
General
Full URL
https://c.bing.com/c.gif?Red3=CTOMS_pd&cbid=k-rzafV0eroCOCSUKVjb8zA1-5febzMlSXcwOCnQ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
150.171.28.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, no-cache, proxy-revalidate, no-store
pragma
no-cache
etag
"a72625a6f6d8dc1:0"
x-msedge-ref
Ref A: EB8C7EE2BF6E491FB9041BF1A5A0C899 Ref B: CHI261140502023 Ref C: 2026-07-22T02:13:23Z
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
42
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
last-modified
Thu, 30 Apr 2026 23:11:17 GMT
x-powered-by
ASP.NET
GET
H2
200
1017
jadserve.postrelease.com/suid/ Frame F31B
43 B
322 B
50ms
41ms
Image
image/gif
23.23.167.209
Amazon.com
General
Full URL
https://jadserve.postrelease.com/suid/1017?vk=k-8bAW80eroCOCSUKVjb8zA1-5feYSE8JcyQajvA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.23.167.209 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-23-23-167-209.compute-1.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
expires
Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin
*
content-length
43
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
GET
H/1.1
200
OK
cookie-sync
sync.outbrain.com/ Frame F31B
0
360 B
37ms
35ms
Image
text/plain
70.42.32.63
Outbrain
General
Full URL
https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-4KW9L0eroCOCSUKVjb8zA1-5feaLcQdWYwqHdQ&initiator=partner
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
70.42.32.63 , United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache
content-length
0
date
Wed, 22 Jul 2026 02:13:23 GMT
x-traceid
3d54a2f0829ab142090782244bf27f33
GET
H2
200
Pug
simage2.pubmatic.com/AdServer/ Frame F31B
42 B
96 B
42ms
39ms
Image
image/gif
207.65.32.88
PubMatic
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-PbFs8UeroCOCSUKVjb8zA1-5feaIsuwjPIHJoA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.32.88 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif; charset=utf-8
server
nginx
GET

pixel_sync
trends.revcontent.com/cm/ Frame F31B
0
0


GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/ Frame F31B
42 B
1 KB
41ms
38ms
Image
image/gif
216.19.192.2
Magnite
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-8FIPI0eroCOCSUKVjb8zA1-5febKOAClLPtylg&expires=30
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.19.192.2 , United States, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
dbf1a3bf291cc252d6b00d854a883c02
Pragma
no-cache
content-length
42
Content-Type
image/gif
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame F31B
43 B
351 B
54ms
47ms
Image
image/gif
216.22.16.9
Leaseweb USA
General
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-i1W4VUeroCOCSUKVjb8zA1-5fea_kKP_6CuPYA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC - Leaseweb USA, Inc., US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Wed, 22 Jul 2026 02:13:22 GMT
pragma
no-cache
content-type
image/gif
GET
H2
200
/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame F31B
0
388 B
183ms
176ms
Image
text/plain
141.226.227.75
TABOOLA-AS Tabool...
General
Full URL
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-n63geEeroCOCSUKVjb8zA1-5febq9swIAWLnqQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.227.75 Tokyo, Japan, ASN200478 (TABOOLA-AS Taboola.com ltd, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-fastly-to-nlb-rtt
177943
content-length
0
date
Wed, 22 Jul 2026 02:13:23 GMT
server
nginx
access-control-allow-credentials
true
GET
H2
200
um
criteo-sync.teads.tv/ Frame F31B
23 B
82 B
46ms
39ms
Image
image/gif
151.101.194.132
Fastly
General
Full URL
https://criteo-sync.teads.tv/um?eid=80&uid=k-0ISRjEeroCOCSUKVjb8zA1-5febYMcEWBwrb5g
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.132 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
pekko-http/1.1.0 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-user-geo
US-EAST-1
cache-control
max-age=0, no-cache, no-store
x-timer
S1784686404.765788,VS0,VE22
x-check-cacheable
NO
via
1.1 varnish
accept-ranges
bytes
x-cache
MISS
content-length
23
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
x-served-by
cache-yyz4545-YYZ
server
pekko-http/1.1.0
x-cache-hits
0
traffic-path
NVADC2, YYZ, USA
GET
H2
200
sync
criteo-partners.tremorhub.com/ Frame F31B
43 B
292 B
49ms
42ms
Image
image/gif
34.237.134.39
Amazon.com
General
Full URL
https://criteo-partners.tremorhub.com/sync?UICR=k-k0vmVkeroCOCSUKVjb8zA1-5feY21DF-jUOl8Q
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.237.134.39 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-237-134-39.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
server
nginx
GET
H3
200
sync.htm
ade.clmbtech.com/uid/ Frame F31B
68 B
89 B
1365ms
234ms
Image
image/jpeg
23.12.145.162
AKAMAI-ASN1 Akama...
General
Full URL
https://ade.clmbtech.com/uid/sync.htm?pid=13079&cuid=k-82JxBEeroCOCSUKVjb8zA1-5feYHXvFXytIxaQ
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
23.12.145.162 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-12-145-162.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
Security Headers
Name Value
Strict-Transport-Security max-age=25920000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=25920000; includeSubdomains
x-content-type-options
nosniff
quic-version
0x00000001
alt-svc
h3=":443"; ma=93600
content-length
68
x-xss-protection
1; mode=block
date
Wed, 22 Jul 2026 02:13:25 GMT
content-type
image/jpeg
x-upstream
10.71.28.95:80
x-frame-options
sameorigin
GET
H2
200
xuid
eb2.3lift.com/ Frame F31B
37 B
248 B
49ms
42ms
Image
image/gif
54.237.4.69
Amazon.com
General
Full URL
https://eb2.3lift.com/xuid?mid=2711&xuid=k-CPX40EeroCOCSUKVjb8zA1-5feZgOPSaSUbYgw&dongle=013b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.237.4.69 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-237-4-69.compute-1.amazonaws.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
37
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
image/gif
GET
H2
200
RX-431cf1de-8952-4768-bb0f-768478c0a626-005
sync.targeting.unrulymedia.com/csync/ Frame F31B
Redirect Chain
  • https://sync.1rx.io/usersync/criteodsp/k-qoSgh0eroCOCSUKVjb8zA1-5feY1rVYhNiVDFQ
  • https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
43 B
377 B
2160ms
39ms
Image
image/gif
69.194.240.13
RhythmOne
General
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
Protocol
H2
Server
69.194.240.13 , United States, ASN26120 (RHYTHMONE - RhythmOne, LLC, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date
Wed, 22 Jul 2026 02:13:25 GMT
content-length
43

Redirect headers

expires
0
cache-control
no-store, no-cache, must-revalidate
location
https://sync.targeting.unrulymedia.com/csync/RX-431cf1de-8952-4768-bb0f-768478c0a626-005
date
Wed, 22 Jul 2026 02:13:23 GMT
pragma
no-cache
content-type
text/html
GET
H3
200
/
www.facebook.com/tr/
0
19 B
75ms
35ms
Image
text/plain
57.144.70.1
Facebook
General
Full URL
https://www.facebook.com/tr/?id=2047499333091544&ev=PageView&dl=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&rl=https%3A%2F%2Fmafiacasino.com%2Flogin&if=false&ts=1784686397738&iw=false&sw=1600&sh=1200&v=2.9.359&r=stable&ec=0&o=28&it=1784686397591&coo=false&expv2[0]=pl1&expv2[1]=el3&expv2[2]=bc1&expv2[3]=ra0&expv2[4]=rp0&expv2[5]=im0&expv2[6]=hf1&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.144.70.1 Reston, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
edge-star-mini-shv-01-xxc1.facebook.com
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=32, rtx=0, c=23, mss=1232, tbw=4988, tp=9, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
alt-svc
h3=":443"; ma=86400
content-length
0
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
text/plain
server
proxygen-bolt
priority
u=1,i
GET
H2
200
sp-3.8.0.js Show response
tracker.ads.sportradar.com/dist//
72 KB
24 KB
489ms
487ms
Script
application/javascript
23.48.203.44
AKAMAI-ASN1 Akama...
General
Full URL
https://tracker.ads.sportradar.com/dist//sp-3.8.0.js
Requested by
Host: tracker.ads.sportradar.com
URL: https://tracker.ads.sportradar.com/dist/tracker.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.48.203.44 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-48-203-44.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
bdcfff76b1a267221f3557b2eeb6b4b28f87eceefae0e25f328ef63c0cb1778f

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

vary
Accept-Encoding
cache-control
max-age=900, public
content-encoding
gzip
x-amz-version-id
V32ng7UtmVBdsU0vK0R8Y9f_TGAxNFMy
etag
"902739d7e2c1e6b737f4f675c76baa27"
accept-ranges
bytes
content-length
23984
x-amz-cf-id
rNReC2CeiFkZEYuiuOEAR_XoM3cUvJ25o854OQFtTt4AOwhsmVh2Uw==
date
Wed, 22 Jul 2026 02:13:24 GMT
content-type
application/javascript
last-modified
Wed, 25 Feb 2026 07:42:43 GMT
server
AmazonS3
x-amz-cf-pop
MCI50-P4
x-amz-server-side-encryption
AES256
GET
H2
200
plf
c1.adform.net/imatch/ Frame 7ECD
0
384 B
34ms
33ms
Image
text/plain
185.167.164.38
ADFORM Adform A/S
General
Full URL
https://c1.adform.net/imatch/plf?name=plff
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.167.164.38 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
86400
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-methods
GET
access-control-allow-origin
*
date
Wed, 22 Jul 2026 02:13:17 GMT
server
nginx
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
GET
H2
200
match
ad.360yield.com/ul_cb/ Frame 7ECD
Redirect Chain
  • https://ad.360yield.com/match?publisher_dsp_id=42&external_user_id=1900642661338238831&Expiration=1785895997
  • https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=1900642661338238831&Expiration=1785895997
43 B
732 B
42ms
42ms
Image
image/gif
54.243.157.64
Amazon.com
General
Full URL
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=1900642661338238831&Expiration=1785895997
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Server
54.243.157.64 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-243-157-64.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://c1.adform.net/

Response headers

access-control-allow-origin
*
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:19 GMT
content-type
image/gif

Redirect headers

access-control-allow-origin
*
location
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=1900642661338238831&Expiration=1785895997
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
0
date
Wed, 22 Jul 2026 02:13:19 GMT
GET

m
ad.yieldlab.net/ Frame 7ECD
0
0


GET
H/1.1
204
No Content
token
token.rubiconproject.com/ Frame 7ECD
0
1 KB
3751ms
37ms
Image
text/plain
216.19.192.2
Magnite
General
Full URL
https://token.rubiconproject.com/token?pid=5232&puid=1900642661338238831
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.19.192.2 , United States, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://c1.adform.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
0ff7a3cf4be68d24beddb47bb8de5701
Pragma
no-cache
GET
H2
200
tpui
ih.adscale.de/adscale-ih/ Frame 7ECD
0
59 B
1369ms
110ms
Image
text/plain
63.181.140.45
Amazon.com
General
Full URL
https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=1900642661338238831&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.181.140.45 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-181-140-45.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://c1.adform.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

date
Wed, 22 Jul 2026 02:13:19 GMT
content-type
text/plain; charset=UTF-8
content-length
0
GET

/
rtb-csync.smartadserver.com/redir/ Frame 7ECD
0
0


GET

u
user-sync.fwmrm.net/ad/ Frame 7ECD
0
0


GET
H2
204
/
csync.loopme.me/ Frame 7ECD
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=1900642661338238831
  • https://csync.loopme.me/?partner_id=1196&uid=1254a2ec-5c6d-429f-9422-1000d186be0e&vt=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
0
168 B
1333ms
108ms
Image
text/plain
35.214.197.234
Google LLC
General
Full URL
https://csync.loopme.me/?partner_id=1196&uid=1254a2ec-5c6d-429f-9422-1000d186be0e&vt=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Server
35.214.197.234 Groningen, Netherlands, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
234.197.214.35.bc.googleusercontent.com
Software
_ /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://c1.adform.net/

Response headers

date
Wed, 22 Jul 2026 02:13:19 GMT
server
_

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
//csync.loopme.me/?partner_id=1196&uid=1254a2ec-5c6d-429f-9422-1000d186be0e&vt=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
content-length
0
alt-svc
h3=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:18 GMT
GET
H3
200
rum
dsum-sec.casalemedia.com/ Frame 7ECD
43 B
736 B
45ms
39ms
Image
image/gif
104.18.27.193
Cloudflare
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=1900642661338238831&expiration=1785895997
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://c1.adform.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=f7m17TX3GKUv7ttw2ZVq7ng6oWIeqWWI6Mlk6wl72BJ5cbk0gq37RUWpzNa9TkMFZlBrGx9lj0p1yL0S4YK4xLoDsUmyVXCCgdq83wc08woGN7NRiEjfoY%2FSDM2oa2AWpMyC0IZCuvfkEQ%3D%3D"}]}
cf-ray
a1eeece37bcf7091-YYZ
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i
GET

info
uipglob.semasio.net/adform/1/ Frame 7ECD
0
0


GET
H/1.1
200
OK
/
ps.eyeota.net/match/bounce/ Frame 7ECD
Redirect Chain
  • https://ps.eyeota.net/match?uid=1900642661338238831&bid=9gdtmu1
  • https://ps.eyeota.net/match/bounce/?uid=1900642661338238831&bid=9gdtmu1
70 B
450 B
72ms
34ms
Image
image/gif
100.59.229.44
Amazon.com
General
Full URL
https://ps.eyeota.net/match/bounce/?uid=1900642661338238831&bid=9gdtmu1
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
HTTP/1.1
Server
100.59.229.44 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-59-229-44.compute-1.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://c1.adform.net/

Response headers

content-length
70
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif

Redirect headers

location
/match/bounce/?uid=1900642661338238831&bid=9gdtmu1
content-length
0
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
date
Wed, 22 Jul 2026 02:13:18 GMT
GET
H2
204
pixel.gif
load77.exelator.com/ Frame 7ECD
Redirect Chain
  • https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=1900642661338238831
  • https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=1900642661338238831&xl8blockcheck=1
  • https://load77.exelator.com/pixel.gif
0
93 B
61ms
51ms
Image
text/plain
44.208.117.202
Amazon.com
General
Full URL
https://load77.exelator.com/pixel.gif
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Server
44.208.117.202 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-44-208-117-202.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://c1.adform.net/

Response headers

server-timing
total;dur=0.000
date
Wed, 22 Jul 2026 02:13:18 GMT
etag
"604f3ce1-0"
server
nginx

Redirect headers

cache-control
no-cache
location
https://load77.exelator.com/pixel.gif
access-control-allow-credentials
true
content-length
0
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif
x-powered-by
Undertow/1
server
nginx
GET
H2
200
sync
pippio.com/api/ Frame 7ECD
Redirect Chain
  • https://idsync.rlcdn.com/398366.gif?partner_uid=1900642661338238831
  • https://idsync.rlcdn.com/1000.gif?memo=CJ6oGBIeChoIARCUdRoTMTkwMDY0MjY2MTMzODIzODgzMRAAGg0Iwc6A0wYSBQjoBxAAQgBKAA
  • https://pippio.com/api/sync?pid=5324&it=1&iv=221dff5b863f29b14b2746291c7b7aa2ff940de24a507e5c2f2740955ec464d0791426b5417dce21&_=2
42 B
551 B
7371ms
88ms
Image
image/gif
107.178.254.65
Google LLC
General
Full URL
https://pippio.com/api/sync?pid=5324&it=1&iv=221dff5b863f29b14b2746291c7b7aa2ff940de24a507e5c2f2740955ec464d0791426b5417dce21&_=2
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Server
107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
65.254.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://c1.adform.net/

Response headers

cache-control
no-cache, no-store
timing-allow-origin
*
via
1.1 google
alt-svc
h3=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
42
date
Wed, 22 Jul 2026 02:13:28 GMT
content-type
image/gif

Redirect headers

cache-control
no-cache, no-store
timing-allow-origin
*
location
https://pippio.com/api/sync?pid=5324&it=1&iv=221dff5b863f29b14b2746291c7b7aa2ff940de24a507e5c2f2740955ec464d0791426b5417dce21&_=2
via
1.1 google
alt-svc
h3=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
GET

qmap
sync.crwdcntrl.net/ Frame 7ECD
0
0


GET
H2
200
sd
eu-u.openx.net/w/1.0/ Frame 7ECD
43 B
97 B
36ms
29ms
Image
image/gif
35.244.159.8
Google LLC
General
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1900642661338238831
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://c1.adform.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
154.47.17.42
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Wed, 22 Jul 2026 02:13:17 GMT
content-type
image/gif
vary
Accept
GET
H2
200
/
c1.adform.net/serving/cookie/match/ Frame 7ECD
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_cm&google_ula=1641347&party=1&google_hm=MTkwMDY0MjY2MTMzODIzODgzMQ&process_consent=T
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEG3rRNb8FRqdUPKajrDPJuU&google_cver=1&google_ula=1641347,0
35 B
590 B
34ms
33ms
Image
image/gif
185.167.164.38
ADFORM Adform A/S
General
Full URL
https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEG3rRNb8FRqdUPKajrDPJuU&google_cver=1&google_ula=1641347,0
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Server
185.167.164.38 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://c1.adform.net/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-methods
GET
expires
-1
access-control-allow-origin
*
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif
server
nginx
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

Redirect headers

cache-control
no-cache, must-revalidate
location
https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEG3rRNb8FRqdUPKajrDPJuU&google_cver=1&google_ula=1641347,0
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
334
date
Wed, 22 Jul 2026 02:13:18 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
setuid
secure.adnxs.com/ Frame 7ECD
Redirect Chain
  • https://secure.adnxs.com/getuid?https://c1.adform.net/serving/cookie/match?party=3&id=$UID&redirect=1
  • https://c1.adform.net/serving/cookie/match?party=3&id=616405946471127822&redirect=1
  • https://secure.adnxs.com/setuid?entity=91&code=1900642661338238831
43 B
1 KB
31ms
31ms
Image
image/gif
68.67.161.208
Xandr Inc.
General
Full URL
https://secure.adnxs.com/setuid?entity=91&code=1900642661338238831
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Server
68.67.161.208 Feasterville, United States, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),
Reverse DNS
806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://c1.adform.net/

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin
154.47.17.42; 154.47.17.42; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid
44eea6ce-b194-45c6-ba6d-4f8422b9d4d4
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:18 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.25.5

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
location
https://secure.adnxs.com/setuid?entity=91&code=1900642661338238831
pragma
no-cache
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-methods
GET
expires
-1
access-control-allow-origin
*
content-length
0
date
Wed, 22 Jul 2026 02:13:18 GMT
server
nginx
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
GET
H2
200
Pug
simage2.pubmatic.com/AdServer/ Frame 7ECD
42 B
345 B
38ms
31ms
Image
image/gif
207.65.32.88
PubMatic
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=1900642661338238831
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.32.88 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://c1.adform.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif; charset=utf-8
server
nginx
GET
H2
200
plf
c1.adform.net/imatch/ Frame 7ECD
0
384 B
41ms
35ms
Image
text/plain
185.167.164.38
ADFORM Adform A/S
General
Full URL
https://c1.adform.net/imatch/plf?name=plfm
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.167.164.38 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
86400
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-methods
GET
access-control-allow-origin
*
date
Wed, 22 Jul 2026 02:13:18 GMT
server
nginx
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
GET

cs
pdw-adf.userreport.com/ Frame 7ECD
0
0


GET

a
a.audrte.com/ Frame 7ECD
0
0


GET
H2
200
match
c1.adform.net/serving/cookie/ Frame 7ECD
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=1586&dpuuid=1900642661338238831&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredirect%3D1
  • https://c1.adform.net/serving/cookie/match?party=1007&cid=34890661687262767462851519540925295226&noredirect=1
35 B
590 B
33ms
32ms
Image
image/gif
185.167.164.38
ADFORM Adform A/S
General
Full URL
https://c1.adform.net/serving/cookie/match?party=1007&cid=34890661687262767462851519540925295226&noredirect=1
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Server
185.167.164.38 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://c1.adform.net/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-methods
GET
expires
-1
access-control-allow-origin
*
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif
server
nginx
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location
https://c1.adform.net/serving/cookie/match?party=1007&cid=34890661687262767462851519540925295226&noredirect=1
dcs
dcs-prod-va6-1-v089-0892b86c3.edge-va6.demdex.com 8 ms
pragma
no-cache
x-tid
JtdFtRiZTII=
expires
Thu, 01 Jan 1970 00:00:00 UTC
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Wed, 22 Jul 2026 02:13:18 GMT
GET
H2
200
g.pixel
aa.agkn.com/adscores/ Frame 7ECD
0
462 B
3053ms
66ms
Image
text/plain
18.239.6.48
Amazon.com
General
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212269628&_puid=1900642661338238831
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.239.6.48 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-239-6-48.yul62.r.cloudfront.net
Software
AAWebServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://c1.adform.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
access-control-allow-methods
GET, OPTIONS
via
1.1 61524e3f823aaa22442fec73d88a7228.cloudfront.net (CloudFront)
expires
0
access-control-allow-origin
*
x-cache
Miss from cloudfront
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
x-amz-cf-id
hmMfsIe_fG0UHPG2lEVJ1ugW_AHwZrRVVow2Y8rLBlRQm-RwrvPUUA==
date
Wed, 22 Jul 2026 02:13:21 GMT
x-amz-cf-pop
YUL62-P3
server
AAWebServer
access-control-allow-headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type
GET

/
dsp.adfarm1.adition.com/cookie/ Frame 7ECD
0
0


GET

ping_match.gif
pm.w55c.net/ Frame 7ECD
0
0


GET

generic
match.adsrvr.org/track/cmf/ Frame 7ECD
0
0


GET

0.gif
id5-sync.com/s/10/ Frame 7ECD
0
0


GET

standard
redirect.frontend.weborama.fr/redirect/ Frame 7ECD
0
0


GET

um
sync.teads.tv/ Frame 7ECD
0
0


GET

/
s.ad.smaato.net/c/ Frame 7ECD
0
0


GET

1900642661338238831
match.contentexchange.me/adform/ Frame 7ECD
0
0


GET

/
bpi.rtactivate.com/tag/ Frame 7ECD
0
0


GET

set_user_agent_id_mapping
cookie-matching.mediarithmics.com/v1/ Frame 7ECD
0
0


GET

/
pixel.onaudience.com/ Frame 7ECD
0
0


GET

xuid
eb2.3lift.com/ Frame 7ECD
0
0


GET

/
pixel.onaudience.com/ Frame 7ECD
0
0


GET

/
onetag-sys.com/match/ Frame 7ECD
0
0


GET
H2
200
plf
c1.adform.net/imatch/ Frame 7ECD
0
384 B
37ms
33ms
Image
text/plain
185.167.164.38
ADFORM Adform A/S
General
Full URL
https://c1.adform.net/imatch/plf?name=plfl
Requested by
Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.167.164.38 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://c1.adform.net/imatch/pixels?bt=0&uid=1900642661338238831&agencyId=7946&advertiserId=2231816&src=tp&rnd=699686
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
86400
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-methods
GET
access-control-allow-origin
*
date
Wed, 22 Jul 2026 02:13:18 GMT
server
nginx
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
GET
H2
200
Pug
simage2.pubmatic.com/AdServer/
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=2&user_id=faecac79-d534-4812-a6bb-ea036e742c6a&cb=03a71994-3807-40a3-9b7e-c9eced0c4065
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
1 B
491 B
371ms
39ms
Image
text/html
207.65.32.88
PubMatic
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Protocol
H2
Server
207.65.32.88 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://mafiacasino.com/

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
text/html; charset=utf-8
server
nginx

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
//simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
content-length
0
alt-svc
h3=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:18 GMT
GET
H2
200
match
ad.360yield.com/ul_cb/
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=2&user_id=faecac79-d534-4812-a6bb-ea036e742c6a&cb=0899d081-acd4-4c20-b190-c50975bb1e5f
  • https://ad.360yield.com/match?publisher_dsp_id=191&external_user_id=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=
  • https://ad.360yield.com/ul_cb/match?publisher_dsp_id=191&external_user_id=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=
43 B
832 B
52ms
50ms
Image
image/gif
3.217.204.162
Amazon.com
General
Full URL
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=191&external_user_id=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=
Protocol
H2
Server
3.217.204.162 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-217-204-162.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://mafiacasino.com/

Response headers

access-control-allow-origin
*
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
43
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif

Redirect headers

access-control-allow-origin
*
location
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=191&external_user_id=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
GET
H3
200
rum
dsum.casalemedia.com/
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=2&user_id=faecac79-d534-4812-a6bb-ea036e742c6a&cb=a551eb92-9bec-408a-8bcd-03f0737bbcbd
  • https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=&us_privacy=
43 B
733 B
43ms
40ms
Image
image/gif
104.18.26.193
Cloudflare
General
Full URL
https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=&us_privacy=
Protocol
H3
Server
104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://mafiacasino.com/

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZO%2ByJXMQa8xDyDXACRvrjRArDGpk6GDGZjT721RozhwGr4zjNSL7tEoWGVh9o6%2B9QcJS7NBpf7AGlgC%2B0vDoZUEwtsBr8TGpe0DULFZQ%2B4jTvgdGbK768quljxwrUOtZw9y4TAlK"}]}
cf-ray
a1eeece4dcbdb0a3-YYZ
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
//dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=1254a2ec-5c6d-429f-9422-1000d186be0e&gdpr=&gdpr_consent=&us_privacy=
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:18 GMT
GET
H2
200
bsw_sync
use.sportradarserving.com/
Redirect Chain
  • https://x.bidswitch.net/syncd?dsp_id=409&user_id=faecac79-d534-4812-a6bb-ea036e742c6a&user_group=2&redir=%2F%2Fuse.sportradarserving.com%2Fbsw_sync%3Fbsw_uid%3D%24%7BBSW_UID%7D
  • https://use.sportradarserving.com/bsw_sync?bsw_uid=1254a2ec-5c6d-429f-9422-1000d186be0e
43 B
103 B
166ms
144ms
Image
image/gif
35.211.155.243
YOUTUBE Google Ir...
General
Full URL
https://use.sportradarserving.com/bsw_sync?bsw_uid=1254a2ec-5c6d-429f-9422-1000d186be0e
Protocol
H2
Server
35.211.155.243 North Charleston, United States, ASN43515 (YOUTUBE Google Ireland Limited, IE),
Reverse DNS
243.155.211.35.bc.googleusercontent.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://mafiacasino.com/

Response headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
date
Wed, 22 Jul 2026 02:13:18 GMT
content-type
image/gif

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
//use.sportradarserving.com/bsw_sync?bsw_uid=1254a2ec-5c6d-429f-9422-1000d186be0e
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:18 GMT
POST
H3
200
browser-logs Show response
mafiacasino.com/
15 B
195 B
328ms
309ms
Fetch
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/browser-logs
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

sec-ch-ua-platform
"Linux"
Authorization
Bearer cxtp_vbQJjf7Tyfdg5zj7Qo16RbLtHt6DlF
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
grpc-status,grpc-message
cf-cache-status
DYNAMIC
cf-ray
a1eeecea6b84ebb9-YYZ
access-control-allow-origin
https://mafiacasino.com
alt-svc
h3=":443"; ma=86400
content-length
15
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:19 GMT
content-type
application/json
vary
accept-encoding
server
cloudflare
priority
u=1,i
GET
H2
200
setuid
ib.adnxs.com/ Frame 4B69
43 B
1 KB
77ms
75ms
Image
image/gif
68.67.181.102
Xandr Inc.
General
Full URL
https://ib.adnxs.com/setuid?entity=52&code=k-SOiJBEeroCOCSUKVjb8zA1-5febnzKsFUUlaVQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.181.102 North Bergen, United States, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),
Reverse DNS
1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin
154.47.17.42; 154.47.17.42; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid
6eba43a0-a20a-4099-b3dc-ec77b98b3f55
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:21 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.25.5
GET
H2
200
ibs:dpid=28645&dpuuid=VBwHDl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDb1RwaEZkUnJwNlRQQSUyRmdRaUVxYmc
dpm.demdex.net/ Frame 4B69
Redirect Chain
  • https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40
  • https://dpm.demdex.net/ibs:dpid=28645&dpuuid=VBwHDl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDb1RwaEZkUnJwNlRQQSUyRmdRaUVxYmc
42 B
716 B
170ms
53ms
Image
image/gif
54.172.43.65
Amazon.com
General
Full URL
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=VBwHDl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDb1RwaEZkUnJwNlRQQSUyRmdRaUVxYmc
Protocol
H2
Server
54.172.43.65 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-172-43-65.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs
dcs-prod-va6-1-v089-08f57b467.edge-va6.demdex.com 2 ms
content-encoding
gzip
pragma
no-cache
x-content-type-options
nosniff
x-tid
pNnVEgE+Sic=
expires
Thu, 01 Jan 1970 00:00:00 UTC
content-length
59
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
location
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=VBwHDl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDb1RwaEZkUnJwNlRQQSUyRmdRaUVxYmc
content-length
0
date
Wed, 22 Jul 2026 02:13:20 GMT
server
Kestrel
server-processing-duration-in-ticks
1292542
GET
H2
200
setuid
ib.adnxs.com/ Frame 8C6D
43 B
1 KB
32ms
32ms
Image
image/gif
68.67.181.102
Xandr Inc.
General
Full URL
https://ib.adnxs.com/setuid?entity=52&code=k-SOiJBEeroCOCSUKVjb8zA1-5febnzKsFUUlaVQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.181.102 North Bergen, United States, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),
Reverse DNS
1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin
154.47.17.42; 154.47.17.42; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid
cc9014fa-efe0-42e5-a657-12e20eb3495d
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:21 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.25.5
GET
H2
200
ibs:dpid=28645&dpuuid=yOLmFV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDcndMT1VmeW5lbDFvWFVqakR3ZDdz
dpm.demdex.net/ Frame 8C6D
Redirect Chain
  • https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40
  • https://dpm.demdex.net/ibs:dpid=28645&dpuuid=yOLmFV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDcndMT1VmeW5lbDFvWFVqakR3ZDdz
42 B
715 B
95ms
56ms
Image
image/gif
54.172.43.65
Amazon.com
General
Full URL
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=yOLmFV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDcndMT1VmeW5lbDFvWFVqakR3ZDdz
Protocol
H2
Server
54.172.43.65 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-172-43-65.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs
dcs-prod-va6-2-v088-0c4c0df8b.edge-va6.demdex.com 2 ms
content-encoding
gzip
pragma
no-cache
x-content-type-options
nosniff
x-tid
p0xKcBPES3g=
expires
Thu, 01 Jan 1970 00:00:00 UTC
content-length
59
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
location
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=yOLmFV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDcndMT1VmeW5lbDFvWFVqakR3ZDdz
content-length
0
date
Wed, 22 Jul 2026 02:13:20 GMT
server
Kestrel
server-processing-duration-in-ticks
1805629
GET
H2
200
setuid
ib.adnxs.com/ Frame 431E
43 B
1 KB
173ms
156ms
Image
image/gif
68.67.181.102
Xandr Inc.
General
Full URL
https://ib.adnxs.com/setuid?entity=52&code=k-SOiJBEeroCOCSUKVjb8zA1-5febnzKsFUUlaVQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.181.102 North Bergen, United States, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),
Reverse DNS
1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin
154.47.17.42; 154.47.17.42; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid
255bc012-cf26-45f4-9c02-de2275f652a1
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 22 Jul 2026 02:13:21 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.25.5
GET
H2
200
ibs:dpid=28645&dpuuid=459dPF9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCTVFiMFJJQXYwb2dTTDY0cTRaVVJE
dpm.demdex.net/ Frame 431E
Redirect Chain
  • https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40
  • https://dpm.demdex.net/ibs:dpid=28645&dpuuid=459dPF9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCTVFiMFJJQXYwb2dTTDY0cTRaVVJE
42 B
715 B
60ms
51ms
Image
image/gif
54.172.43.65
Amazon.com
General
Full URL
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=459dPF9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCTVFiMFJJQXYwb2dTTDY0cTRaVVJE
Protocol
H2
Server
54.172.43.65 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-172-43-65.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs
dcs-prod-va6-2-v088-0c04b8054.edge-va6.demdex.com 3 ms
content-encoding
gzip
pragma
no-cache
x-content-type-options
nosniff
x-tid
O3/9NUrbSFw=
expires
Thu, 01 Jan 1970 00:00:00 UTC
content-length
59
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Wed, 22 Jul 2026 02:13:21 GMT
content-type
image/gif

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
location
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=459dPF9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCTVFiMFJJQXYwb2dTTDY0cTRaVVJE
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
server
Kestrel
server-processing-duration-in-ticks
1332871
GET
H2
200
g.pixel
aa.agkn.com/adscores/ Frame 4B69
Redirect Chain
  • https://gum.criteo.com/sync?c=9&r=1&a=1&u=https%3A%2F%2Faa.agkn.com%2Fadscores%2Fg.pixel%3Fsid%3D9212273938%26ct%3D%40USERID%40
  • https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=tuhjv19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCWE1rNUNNRW0xWU5MSmtyZFZRb1E0
0
461 B
133ms
42ms
Image
text/plain
18.239.6.20
Amazon.com
General
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=tuhjv19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCWE1rNUNNRW0xWU5MSmtyZFZRb1E0
Protocol
H2
Server
18.239.6.20 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-239-6-20.yul62.r.cloudfront.net
Software
AAWebServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
access-control-allow-methods
GET, OPTIONS
via
1.1 61524e3f823aaa22442fec73d88a7228.cloudfront.net (CloudFront)
expires
0
access-control-allow-origin
*
x-cache
Miss from cloudfront
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
x-amz-cf-id
H2ELI2ptmGq9gPguyEswuOV0d3OVJPQEwcfVuP9Qlm7gWbyh_YFm4A==
date
Wed, 22 Jul 2026 02:13:22 GMT
x-amz-cf-pop
YUL62-P3
server
AAWebServer
access-control-allow-headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
location
https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=tuhjv19ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVCWE1rNUNNRW0xWU5MSmtyZFZRb1E0
content-length
0
date
Wed, 22 Jul 2026 02:13:20 GMT
server
Kestrel
server-processing-duration-in-ticks
1713670
GET
H2
200
g.pixel
aa.agkn.com/adscores/ Frame 8C6D
Redirect Chain
  • https://gum.criteo.com/sync?c=9&r=1&a=1&u=https%3A%2F%2Faa.agkn.com%2Fadscores%2Fg.pixel%3Fsid%3D9212273938%26ct%3D%40USERID%40
  • https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=tAfbuV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDWTl2RVVkdUhTckhRR1UwY0ZWa0Rz
0
463 B
94ms
41ms
Image
text/plain
18.239.6.20
Amazon.com
General
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=tAfbuV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDWTl2RVVkdUhTckhRR1UwY0ZWa0Rz
Protocol
H2
Server
18.239.6.20 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-239-6-20.yul62.r.cloudfront.net
Software
AAWebServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
access-control-allow-methods
GET, OPTIONS
via
1.1 61524e3f823aaa22442fec73d88a7228.cloudfront.net (CloudFront)
expires
0
access-control-allow-origin
*
x-cache
Miss from cloudfront
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
x-amz-cf-id
5zwsdfwcUAyR28hIG7-lX8pcNQUDyKQ8VS4xtNOddxZnCxlPYZquIg==
date
Wed, 22 Jul 2026 02:13:22 GMT
x-amz-cf-pop
YUL62-P3
server
AAWebServer
access-control-allow-headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
location
https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=tAfbuV9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVDWTl2RVVkdUhTckhRR1UwY0ZWa0Rz
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
server
Kestrel
server-processing-duration-in-ticks
1232016
GET
H2
200
g.pixel
aa.agkn.com/adscores/ Frame 431E
Redirect Chain
  • https://gum.criteo.com/sync?c=9&r=1&a=1&u=https%3A%2F%2Faa.agkn.com%2Fadscores%2Fg.pixel%3Fsid%3D9212273938%26ct%3D%40USERID%40
  • https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=sqsvUl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBSCUyRmhpJTJGVDJLTUtTR09vSHJ6dk5ZMQ
0
461 B
55ms
44ms
Image
text/plain
18.239.6.20
Amazon.com
General
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=sqsvUl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBSCUyRmhpJTJGVDJLTUtTR09vSHJ6dk5ZMQ
Protocol
H2
Server
18.239.6.20 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-239-6-20.yul62.r.cloudfront.net
Software
AAWebServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
access-control-allow-methods
GET, OPTIONS
via
1.1 61524e3f823aaa22442fec73d88a7228.cloudfront.net (CloudFront)
expires
0
access-control-allow-origin
*
x-cache
Miss from cloudfront
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
x-amz-cf-id
zQj19uxuW0Y93CiLf9WbrOwxpTkjNltC3SOSptRYPgGUcfY3utDs1A==
date
Wed, 22 Jul 2026 02:13:22 GMT
x-amz-cf-pop
YUL62-P3
server
AAWebServer
access-control-allow-headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
private, no-cache, max-age=0, must-revalidate
location
https://aa.agkn.com/adscores/g.pixel?sid=9212273938&ct=sqsvUl9ZejFRSWdXemVMVjYwdjI3STYyNnR1Q2R2QUxNSHRPd3Q2UWgycEp0WWVBSCUyRmhpJTJGVDJLTUtTR09vSHJ6dk5ZMQ
content-length
0
date
Wed, 22 Jul 2026 02:13:21 GMT
server
Kestrel
server-processing-duration-in-ticks
1579490
POST
H2
204
collect Show response
www.google-analytics.com/g/
0
57 B
47ms
46ms
Fetch
text/plain
172.253.63.101
Google LLC
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-81P3YM2SHW&gtm=45je67k1v9220580783z89220570210za20gzb9220570210zd9220570210&_p=1784686394829&gcs=G100&gcd=13p3p3p3p5l1&npa=1&dma_cps=-&dma=0&gdid=dMmY1Mm&are=1&cid=1437553754.1784686397&frm=0&ngs=1&pscdl=denied&rcb=19&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B150.0.7871.128%7CGoogle%2520Chrome%3B150.0.7871.128%7CNot%253BA%253DBrand%3B8.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=en-ca&_s=4&tag_exp=115616986~115938465~115938469~118897920~118897930~119773332~119896802&sid=1784686397&sct=1&seg=0&dl=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&dr=https%3A%2F%2Fmafiacasino.com%2Flogin&dt=MafiaCasino%20Online%20Casino%20%26%20Online%20Betting%20Sportsbook&en=clickEvent_scroll&ep.action=Fast%20Login%20Email%20Tab%20Select&ep.label=Fast%20Login%20Email%20Tab%20Select&ep.category=FastRegistrationLogin&ep.eventType=manual&ep.eventName=scroll&_et=15&tfd=7788
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.101 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bi-in-f101.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:139:0
report-to
{"group":"ascnsrsggc:139:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:139:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://mafiacasino.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:139:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 22 Jul 2026 02:13:22 GMT
content-type
text/plain
server
Golfe2
POST
H3
200
browser-logs Show response
mafiacasino.com/
15 B
195 B
249ms
238ms
Fetch
application/json
185.207.196.198
nalmi-as NALMI LI...
General
Full URL
https://mafiacasino.com/browser-logs
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.207.196.198 , Marshall Islands, ASN213846 (nalmi-as NALMI LIMITED, MH),
Reverse DNS
Software
cloudflare /
Resource Hash
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

sec-ch-ua-platform
"Linux"
Authorization
Bearer cxtp_vbQJjf7Tyfdg5zj7Qo16RbLtHt6DlF
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
grpc-status,grpc-message
cf-cache-status
DYNAMIC
cf-ray
a1eeed048b5bebb9-YYZ
access-control-allow-origin
https://mafiacasino.com
alt-svc
h3=":443"; ma=86400
content-length
15
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:23 GMT
content-type
application/json
vary
accept-encoding
server
cloudflare
priority
u=1,i
POST
H3
200
browser-logs
mafiacasino.com/
15 B
0
601ms
599ms
Fetch
application/json

General
Full URL
https://mafiacasino.com/browser-logs
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Server
-, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Authorization
Bearer cxtp_vbQJjf7Tyfdg5zj7Qo16RbLtHt6DlF
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
grpc-status,grpc-message
cf-cache-status
DYNAMIC
cf-ray
a1eeed1a28e4ebb9-YYZ
alt-svc
h3=":443"; ma=86400
access-control-allow-origin
https://mafiacasino.com
content-length
15
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:26 GMT
content-type
application/json
vary
accept-encoding
server
cloudflare
priority
u=1,i
GET
H2
200
event Show response
sslwidget.criteo.com/
18 B
0
54ms
53ms
Script
application/x-javascript

General
Full URL
https://sslwidget.criteo.com/event?a=%5B125125%2C125126%2C125127%2C125128%2C125129%2C125130%5D&v=5.46.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26tms%3DCriteo%2520GTM%2520Enhanced%2520(Leads)%2520-%2520v5%26p%3D1&p2=e%3Ddis%26a%3D%255B125125%252C125126%252C125127%252C125128%252C125129%252C125130%255D&bundle=hmfDYV9WcURpeDhZNVZUQU9vZFJqMmROSHdnRk91V0N1Z0JDVHNHWVNTOFZsbVE2WmJFVTJCejU4Q2w5ODFsU2Vyb1lBQ3RqU0JIZVEyUDMyJTJGUEtlNyUyQnZ1YlN5eVZFUFNxSDhRYldwN0cwamxKUG5SYWlROWNxZ3ZGNndka0lVSzNGTmxXa2V3a3RSdGZXcTl3cUJiQUNmZ1pBJTNEJTNE&tld=mafiacasino.com&dy=1&fu=https%253A%252F%252Fmafiacasino.com%252Fca%252Flogin&pu=https%253A%252F%252Fmafiacasino.com%252Flogin&ceid=3df30c1a-def3-4c72-a8ce-eed811d42d8a
Requested by
Host: dynamic.criteo.com
URL: https://dynamic.criteo.com/js/ld/ld.js?a=125125&a=125126&a=125127&a=125128&a=125129&a=125130
Protocol
H2
Server
-, , ASN (),
Reverse DNS
Software
Kestrel /
Resource Hash
c29326c96dc78662cf650d385a95abd53d7a34ccd629d71b07a08f7865f639be
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
timing-allow-origin
*
content-encoding
gzip
pragma
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
10468876
expires
0
access-control-allow-origin
*
p3p
NON DSP COR CURa PSA PSD OUR BUS NAV STA
date
Wed, 22 Jul 2026 02:13:29 GMT
content-type
application/x-javascript
server
Kestrel
POST
H3
200
browser-logs
mafiacasino.com/
15 B
0
177ms
177ms
Fetch
application/json

General
Full URL
https://mafiacasino.com/browser-logs
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Server
-, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Authorization
Bearer cxtp_vbQJjf7Tyfdg5zj7Qo16RbLtHt6DlF
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
grpc-status,grpc-message
cf-cache-status
DYNAMIC
cf-ray
a1eeed3a7fddebb9-YYZ
alt-svc
h3=":443"; ma=86400
access-control-allow-origin
https://mafiacasino.com
content-length
15
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:32 GMT
content-type
application/json
vary
accept-encoding
server
cloudflare
priority
u=1,i
POST
H3
204
collect
www.google-analytics.com/g/
0
0
58ms
58ms
Fetch
text/plain

General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-81P3YM2SHW&gtm=45je67k1v9220580783z89220570210za20gzb9220570210zd9220570210&_p=1784686394829&gcs=G100&gcd=13p3p3p3p5l1&npa=1&dma_cps=-&dma=0&gdid=dMmY1Mm&are=1&cid=1437553754.1784686397&frm=0&ngs=1&pscdl=denied&rcb=19&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B150.0.7871.128%7CGoogle%2520Chrome%3B150.0.7871.128%7CNot%253BA%253DBrand%3B8.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=en-ca&_s=5&tag_exp=115616986~115938465~115938469~118897920~118897930~119773332~119896802&sid=1784686397&sct=1&seg=1&dl=https%3A%2F%2Fmafiacasino.com%2Fca%2Flogin&dr=https%3A%2F%2Fmafiacasino.com%2Flogin&dt=MafiaCasino%20Online%20Casino%20%26%20Online%20Betting%20Sportsbook&en=clickEvent_forgotPassword&ep.action=Forgot%20Password&ep.label=Forgot%20Password&ep.category=Standard&ep.eventType=manual&ep.eventName=forgotPassword&_et=12937&tfd=20730
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Server
-, , ASN (),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:139:0
report-to
{"group":"ascnsrsggc:139:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:139:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-origin
https://mafiacasino.com
content-length
0
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:139:0
date
Wed, 22 Jul 2026 02:13:35 GMT
content-type
text/plain
server
Golfe2
POST
H3
200
/
mafiacasino.com/cdn/edge/dd/js/
236 B
0
93ms
93ms
XHR
application/json

General
Full URL
https://mafiacasino.com/cdn/edge/dd/js/
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Server
-, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

traceparent
00-1bf3c4d9ff4ae1ed5a3fdb42d7225c8c-5e83c6b09580e214-01
sec-ch-ua-platform
"Linux"
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-type
application/x-www-form-urlencoded
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache, no-store, must-revalidate
content-encoding
br
cf-cache-status
DYNAMIC
pragma
no-cache
cf-ray
a1eeed4f4c21ebb9-YYZ
expires
0
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:35 GMT
content-type
application/json;charset=utf-8
vary
accept-encoding
server
cloudflare
priority
u=1,i
GET
H/1.1
200
OK
pstats.html Show response
a.rfihub.com/ Frame 80B2
26 B
873 B
35ms
32ms
Document
text/html
199.38.167.131
Rocket Fuel Inc.
General
Full URL
https://a.rfihub.com/pstats.html?rb=55629&ca=20874641&ri=4e2b43a0b05601a54cd5d68955cc1c8a&stats=undefined&ra=2138447728798505
Requested by
Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
199.38.167.131 , United States, ASN54312 (ROCKETFUEL - Rocket Fuel Inc., US),
Reverse DNS
Software
Jetty(9.4.51.v20230217) /
Resource Hash
f70b370debd085dd9e9fb6495c796cdccf41c44574cc185dbe124f3ea8237623

Request headers

Referer
https://mafiacasino.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

Content-Length
26
Content-Type
text/html;charset=iso-8859-1
Date
Wed, 22 Jul 2026 02:13:36 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server
Jetty(9.4.51.v20230217)
POST
H3
200
browser-logs
mafiacasino.com/
15 B
0
254ms
252ms
Fetch
application/json

General
Full URL
https://mafiacasino.com/browser-logs
Requested by
Host: mafiacasino.com
URL: https://mafiacasino.com/cfr/20961f2b14bc405/p/17-07-2026-13-36-16-e8ebdd94/polyfills.c8c0f3e71e7b8c56.js
Protocol
H3
Server
-, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Authorization
Bearer cxtp_vbQJjf7Tyfdg5zj7Qo16RbLtHt6DlF
Referer
https://mafiacasino.com/ca/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
grpc-status,grpc-message
cf-cache-status
DYNAMIC
cf-ray
a1eeed5cdb4febb9-YYZ
alt-svc
h3=":443"; ma=86400
access-control-allow-origin
https://mafiacasino.com
content-length
15
server-timing
cfExtPri
date
Wed, 22 Jul 2026 02:13:37 GMT
content-type
application/json
vary
accept-encoding
server
cloudflare
priority
u=1,i

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/ed3a25f6-13df-41e8-b72f-d57670939aef
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/e8f1ee6c-415f-427f-bdf6-2758d0d578ce
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/a914f8bc-556d-47de-a424-1a4d7945db4d
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/a4eb6e2a-db1f-4e17-8d8a-965817fe0722
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/301dd53d-47d6-452e-b7cb-af75c7fb555f
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/be313a37-6817-4f00-807a-334027c14918
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/1bd76757-29cd-43be-92f1-4a1eb6e12af4
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/848c3fae-13a2-410c-b786-2c9847e8bb3c
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/8d517b0b-5e8f-4f01-952c-786336102203
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/f4475ed2-6d13-463c-98dc-2d7db7b57f30
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/278f010c-1032-4dac-9a07-c492cb8409aa
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/5e4b7cee-f449-442c-b837-a4fa47cd0070
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/9fc8c8e2-24d9-419d-be4f-5314bdddeeec
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/ea77766e-c5d2-4298-99b1-844c1b8aab51
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/9288bf52-9e73-4c10-b5e7-53affc59153e
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/251f94a9-c05d-485f-9200-2e2166d37c15
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/283cb316-98e5-44af-9ae2-a010fa6d4225
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/a2d4b50b-7be3-4635-8132-044bfbe85475
Domain
mafiacasino.com
URL
https://mafiacasino.com/cdn-cgi/challenge-platform/h/b/jsd/oneshot/3104729c556c/0.47982491241757264:1784682620:y2nGJhuO_3Ull-gh6e_yB5JfpnvKC_aaLxfiil8OcKI/a1eeecc2b9ea92c6
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/fff62ec8-c36a-456a-a7af-e34deaf8f181
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/48d6ad93-75d6-43a7-8594-34e8305ac2ee
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/5df72d05-e0ad-452d-8131-4b22f0219bb4
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/42f86efd-81f3-4158-81b7-3af9d0d2ccbd
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/d5af0acd-b80b-41aa-a0da-c9816adba365
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/cb341c79-564a-4e48-86f8-df1818a69f40
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/e921e941-7ea8-425b-a80f-fc38b8055bac
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/2d38ae31-a040-4831-a4d2-591947e66f23
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/7596bd1c-35ac-4168-84f8-59abf64ada33
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/cfd9258e-c04d-4219-8c1d-86e0766fe994
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/d8ef0268-cb81-466d-9917-e727440169cd
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/86f1b53e-1a7d-4db2-8526-4291e60578dc
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/40eb1cd9-98c4-4067-aa7c-e27573ae5234
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/0c77ddbc-89f0-48b2-aab6-811dbe434082
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/6e91f8b6-f8a8-4e72-bf11-1ae25b76d4f7
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/3db731a3-8985-46be-b40a-1dcb62dc2df8
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/f23d32e7-9eff-49f4-8e81-4b762f8069b6
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/bab2af94-a311-40a6-871f-19bf8652cb03
Domain
event.getblue.io
URL
https://event.getblue.io/js/blue-tag.min.js
Domain
thrtle.com
URL
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=f539a137-8130-4240-8ed0-5ffc143770ff&us_privacy=1YN-
Domain
idsync.rlcdn.com
URL
https://idsync.rlcdn.com/360947.gif?partner_uid=970033204402624982
Domain
aa.agkn.com
URL
https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=970033204402624982
Domain
mafiacasino.com
URL
blob:https://mafiacasino.com/8f1a9315-a727-48b4-99f3-b410dbefefd7
Domain
trends.revcontent.com
URL
https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k--ZMlRUeroCOCSUKVjb8zA1-5feYM0gDa56cncA
Domain
trends.revcontent.com
URL
https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k--ZMlRUeroCOCSUKVjb8zA1-5feYM0gDa56cncA
Domain
b1sync.zemanta.com
URL
https://b1sync.zemanta.com/usersync/liveintent/?cb=//i.liadm.com/s/35004?bidder_id%3D98254%26bidder_uuid%3D__ZUID__
Domain
trends.revcontent.com
URL
https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k--ZMlRUeroCOCSUKVjb8zA1-5feYM0gDa56cncA
Domain
trends.revcontent.com
URL
https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k--ZMlRUeroCOCSUKVjb8zA1-5feYM0gDa56cncA
Domain
trends.revcontent.com
URL
https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k--ZMlRUeroCOCSUKVjb8zA1-5feYM0gDa56cncA
Domain
trends.revcontent.com
URL
https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k--ZMlRUeroCOCSUKVjb8zA1-5feYM0gDa56cncA
Domain
ad.yieldlab.net
URL
https://ad.yieldlab.net/m?dt_id=4879&ext_id=1900642661338238831
Domain
rtb-csync.smartadserver.com
URL
https://rtb-csync.smartadserver.com/redir/?partnerid=22&partneruserid=1900642661338238831&redirurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d10%26cid%3DSMART_USER_ID
Domain
user-sync.fwmrm.net
URL
https://user-sync.fwmrm.net/ad/u?mode=user-register&dspid=55&dspuid=1900642661338238831
Domain
uipglob.semasio.net
URL
https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=1900642661338238831&sInitiator=external
Domain
sync.crwdcntrl.net
URL
https://sync.crwdcntrl.net/qmap?c=6466&tp=ADFM&tpid=1900642661338238831
Domain
pdw-adf.userreport.com
URL
https://pdw-adf.userreport.com/cs
Domain
a.audrte.com
URL
https://a.audrte.com/a?adform_uid=1900642661338238831
Domain
dsp.adfarm1.adition.com
URL
https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fc1.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1049%26cid%3D%25%25COOKIE%25%25
Domain
pm.w55c.net
URL
https://pm.w55c.net/ping_match.gif?st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_
Domain
match.adsrvr.org
URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=71ei9rr&ttd_tpi=1
Domain
id5-sync.com
URL
https://id5-sync.com/s/10/0.gif?puid=1900642661338238831
Domain
redirect.frontend.weborama.fr
URL
https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fc1.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D
Domain
sync.teads.tv
URL
https://sync.teads.tv/um?eid=119&uid=1900642661338238831
Domain
s.ad.smaato.net
URL
https://s.ad.smaato.net/c/?dspInit=1067&dspCookie=1900642661338238831
Domain
match.contentexchange.me
URL
https://match.contentexchange.me/adform/1900642661338238831?redirect_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1219
Domain
bpi.rtactivate.com
URL
https://bpi.rtactivate.com/tag/?id=16974&user_id=1900642661338238831
Domain
cookie-matching.mediarithmics.com
URL
https://cookie-matching.mediarithmics.com/v1/set_user_agent_id_mapping?dom_token=adform25&identifier=1900642661338238831
Domain
pixel.onaudience.com
URL
https://pixel.onaudience.com/?mapped=1900642661338238831&partner=68
Domain
eb2.3lift.com
URL
https://eb2.3lift.com/xuid?mid=7354&xuid=1900642661338238831&dongle=AD20
Domain
pixel.onaudience.com
URL
https://pixel.onaudience.com/?partner=290&mapped=1900642661338238831
Domain
onetag-sys.com
URL
https://onetag-sys.com/match/?int_id=220&uid=1900642661338238831

Verdicts & Comments Add Verdict or Comment

264 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| webpackChunkmafiacasino function| Zone function| __zone_symbol__Promise function| __zone_symbol__fetch function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__requestAnimationFrame function| __zone_symbol__cancelAnimationFrame function| __zone_symbol__webkitRequestAnimationFrame function| __zone_symbol__webkitCancelAnimationFrame function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__IntersectionObserver function| __zone_symbol__FileReader boolean| __zone_symbol__ononsearchpatched boolean| __zone_symbol__ononappinstalledpatched boolean| __zone_symbol__ononbeforeinstallpromptpatched boolean| __zone_symbol__ononabortpatched boolean| __zone_symbol__ononbeforeinputpatched boolean| __zone_symbol__ononbeforematchpatched boolean| __zone_symbol__ononbeforetogglepatched boolean| __zone_symbol__ononblurpatched boolean| __zone_symbol__ononcancelpatched boolean| __zone_symbol__ononcanplaypatched boolean| __zone_symbol__ononcanplaythroughpatched boolean| __zone_symbol__ononchangepatched boolean| __zone_symbol__ononclickpatched boolean| __zone_symbol__ononclosepatched boolean| __zone_symbol__ononcommandpatched boolean| __zone_symbol__ononcontentvisibilityautostatechangepatched boolean| __zone_symbol__ononcontextlostpatched boolean| __zone_symbol__ononcontextmenupatched boolean| __zone_symbol__ononcontextrestoredpatched boolean| __zone_symbol__ononcuechangepatched boolean| __zone_symbol__onondblclickpatched boolean| __zone_symbol__onondragpatched boolean| __zone_symbol__onondragendpatched boolean| __zone_symbol__onondragenterpatched boolean| __zone_symbol__onondragleavepatched boolean| __zone_symbol__onondragoverpatched boolean| __zone_symbol__onondragstartpatched boolean| __zone_symbol__onondroppatched boolean| __zone_symbol__onondurationchangepatched boolean| __zone_symbol__ononemptiedpatched boolean| __zone_symbol__ononendedpatched boolean| __zone_symbol__ononerrorpatched boolean| __zone_symbol__ononfocuspatched boolean| __zone_symbol__ononformdatapatched boolean| __zone_symbol__ononinputpatched boolean| __zone_symbol__ononinvalidpatched boolean| __zone_symbol__ononkeydownpatched boolean| __zone_symbol__ononkeypresspatched boolean| __zone_symbol__ononkeyuppatched boolean| __zone_symbol__ononloadpatched boolean| __zone_symbol__ononloadeddatapatched boolean| __zone_symbol__ononloadedmetadatapatched boolean| __zone_symbol__ononloadstartpatched boolean| __zone_symbol__ononmousedownpatched boolean| __zone_symbol__ononmouseenterpatched boolean| __zone_symbol__ononmouseleavepatched boolean| __zone_symbol__ononmousemovepatched boolean| __zone_symbol__ononmouseoutpatched boolean| __zone_symbol__ononmouseoverpatched boolean| __zone_symbol__ononmouseuppatched boolean| __zone_symbol__ononmousewheelpatched boolean| __zone_symbol__ononpausepatched boolean| __zone_symbol__ononplaypatched boolean| __zone_symbol__ononplayingpatched boolean| __zone_symbol__ononprogresspatched boolean| __zone_symbol__ononratechangepatched boolean| __zone_symbol__ononresetpatched boolean| __zone_symbol__ononresizepatched boolean| __zone_symbol__ononscrollpatched boolean| __zone_symbol__ononscrollendpatched boolean| __zone_symbol__ononsecuritypolicyviolationpatched boolean| __zone_symbol__ononseekedpatched boolean| __zone_symbol__ononseekingpatched boolean| __zone_symbol__ononselectpatched boolean| __zone_symbol__ononslotchangepatched boolean| __zone_symbol__ononstalledpatched boolean| __zone_symbol__ononsubmitpatched boolean| __zone_symbol__ononsuspendpatched boolean| __zone_symbol__onontimeupdatepatched boolean| __zone_symbol__onontogglepatched boolean| __zone_symbol__ononvolumechangepatched boolean| __zone_symbol__ononwaitingpatched boolean| __zone_symbol__ononwebkitanimationendpatched boolean| __zone_symbol__ononwebkitanimationiterationpatched boolean| __zone_symbol__ononwebkitanimationstartpatched boolean| __zone_symbol__ononwebkittransitionendpatched boolean| __zone_symbol__ononwheelpatched boolean| __zone_symbol__ononauxclickpatched boolean| __zone_symbol__onongotpointercapturepatched boolean| __zone_symbol__ononlostpointercapturepatched boolean| __zone_symbol__ononpointerdownpatched boolean| __zone_symbol__ononpointermovepatched boolean| __zone_symbol__ononpointeruppatched boolean| __zone_symbol__ononpointercancelpatched boolean| __zone_symbol__ononpointeroverpatched boolean| __zone_symbol__ononpointeroutpatched boolean| __zone_symbol__ononpointerenterpatched boolean| __zone_symbol__ononpointerleavepatched boolean| __zone_symbol__ononselectstartpatched boolean| __zone_symbol__ononselectionchangepatched boolean| __zone_symbol__ononanimationcancelpatched boolean| __zone_symbol__ononanimationendpatched boolean| __zone_symbol__ononanimationiterationpatched boolean| __zone_symbol__ononanimationstartpatched boolean| __zone_symbol__onontransitionrunpatched boolean| __zone_symbol__onontransitionstartpatched boolean| __zone_symbol__onontransitionendpatched boolean| __zone_symbol__onontransitioncancelpatched boolean| __zone_symbol__ononbeforexrselectpatched boolean| __zone_symbol__ononafterprintpatched boolean| __zone_symbol__ononbeforeprintpatched boolean| __zone_symbol__ononbeforeunloadpatched boolean| __zone_symbol__ononhashchangepatched boolean| __zone_symbol__ononlanguagechangepatched boolean| __zone_symbol__ononmessagepatched boolean| __zone_symbol__ononmessageerrorpatched boolean| __zone_symbol__ononofflinepatched boolean| __zone_symbol__onononlinepatched boolean| __zone_symbol__ononpagehidepatched boolean| __zone_symbol__ononpageshowpatched boolean| __zone_symbol__ononpopstatepatched boolean| __zone_symbol__ononrejectionhandledpatched boolean| __zone_symbol__ononstoragepatched boolean| __zone_symbol__ononunhandledrejectionpatched boolean| __zone_symbol__ononunloadpatched boolean| __zone_symbol__onondevicemotionpatched boolean| __zone_symbol__onondeviceorientationpatched boolean| __zone_symbol__onondeviceorientationabsolutepatched boolean| __zone_symbol__ononpointerrawupdatepatched boolean| __zone_symbol__ononpageswappatched boolean| __zone_symbol__ononpagerevealpatched boolean| __zone_symbol__ononscrollsnapchangepatched boolean| __zone_symbol__ononscrollsnapchangingpatched boolean| __zone_symbol__onongamepadconnectedpatched boolean| __zone_symbol__onongamepaddisconnectedpatched function| __zone_symbol__queueMicrotask object| __zone_symbol__pagehidefalse object| __tti object| CoralogixRum object| __zone_symbol__popstatefalse object| __zone_symbol__hashchangefalse object| __zone_symbol__pageshowfalse object| dataLayer boolean| prerenderReady object| userAgent object| sdkConfig object| rumSessionManager object| __zone_symbol__errorfalse object| __zone_symbol__unhandledrejectionfalse object| __zone_symbol__visibilitychangetrue object| __zone_symbol__prerenderingchangetrue object| __zone_symbol__pageshowtrue object| __zone_symbol__keydowntrue object| __zone_symbol__clicktrue object| __zone_symbol__loadtrue object| rumInternalData object| attrProcessor object| rumSnapshotManager object| __zone_symbol__beforeunloadfalse object| __zone_symbol__loadfalse function| _0x1408 function| _0x4f44 object| seon function| getAngularTestability function| getAllAngularTestabilities function| getAllAngularRootElements object| frameworkStabilizers string| ddjskey object| ddoptions object| DataDomeJsTag boolean| dataDomeProcessed object| dataDomeOptions object| google_tag_manager object| google_tag_data function| hj object| _hjSettings string| selector object| srtmCommands object| x object| y function| _rfi string| var5 string| var50 object| _adftrack object| criteo_q function| Inputmask object| litPropertyMetadata object| reactiveElementVersions object| litHtmlVersions object| litElementVersions function| QrCreator object| __zone_symbol__focusfalse object| OnfidoDistribution object| Adform object| __zone_symbol__messagefalse object| turnstile object| CookieScriptData function| CookieScript function| gtag object| __zone_symbol__CookieScriptConsentKeyUpdatefalse object| a string| b function| fbq function| _fbq function| extend function| RocketfuelBCPInclude function| RocketfuelBCPClass function| RocketfuelUtils object| RocketfuelBCP object| hjSiteSettings object| hjLazyModules function| hjBootstrap object| hjBootstrapCalled object| Criteo object| cto_csm_CspLogger object| __zone_symbol__securitypolicyviolationfalse object| __zone_symbol__messagetrue function| onYouTubeIframeAPIReady object| __zone_symbol__blurfalse object| gaGlobal object| __sf object| iconvert object| KJUR object| __zone_symbol__visibilitychangefalse object| adf function| detectMatch function| applyReplacement function| tryUnifiedUpdate object| __zone_symbol__scrolltrue object| __zone_symbol__pointerdowntrue object| __zone_symbol__mousemovetrue object| _srt_namespace function| _srt_argus function| _ads_popstate_listener object| __zone_symbol__historyChangefalse object| _ads object| __zone_symbol__hotjar-survey-eventfalse object| __zone_symbol__datadome-det-afalse object| cspDomains object| GlobalSnowplowNamespace function| snowplowApi function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener function| eventListeners function| removeAllListeners

122 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
i.liadm.com/s 1970-01-21
16:27:58
Name: _li_ss
Value: CkkKBgj5ARCUHgoGCPcBEJQeCgYIgQEQlB4KBQgMEJ4eCgYI9QEQlB4KBgiiARCUHgoJCP____8HEJ4eCgUIfhCUHgoGCKMBEJYe
.oafiaca5inuo.com/ 1970-01-21
15:44:48
Name: __cf_bm
Value: v7IAQ.i4DtQl3gUpvhNypgnLH5scvTceVX5Hg4gzsok-1784686392.6324604-1.0.1.1-L0L49x4leY8fyQd4jKImSBTL0.TpV8Z5NR7NC1hcQuff6IiDPSNR5FrTwaRBNDApGF4sm9KKGOu807nCHAUyQc7Ce5pfgbL0yTAcsOxSt4MkAATqeQjupAcmJy2qPLnM
.mafiacasino.com/ 1970-01-22
00:30:22
Name: cf_clearance
Value: Md_fQ8Jf0ivibLNYY3mysrqvyVC5vJkxn6GJe3mBvkc-1784686395-1.2.1.1-SdLylstyzd4PjFpAnjkXGKxXF96XdZyHm2g7YR7aKiyTQaGxlVudkv11ggGXx0xLqLe_H0de095LAOFCJmzTs4lUuYP8FWTtmhJhH2lU.fAU_ta72LVCZXNTMLwNVmlGZXMZ8EHN5S5kooS.wZ7qBLLa2daoS.UFzTxKYIscXKtCw.0jb0qAM.80npPoU0aiUWFhXJ0uMwtyTP28_pA38sD.aCHfQtK.zHcTjDKMWAfbFnwdDKK4KzyVepTNWD5aFWU5d7ypZcQbIqGe4b3.z_7cy0n4lR4r90LwxMgqZFJ06PXlTgHVuUmf8j8SDnd7Qs53KjbVX4Uacwex2WFUnw
.mafiacasino.com/ 1970-01-21
15:44:48
Name: __cf_bm
Value: Ff0OQ2nMTgGpVlGy9hRrNR0qc08MkIMZeTwFShnlIJg-1784686395.0421867-1.0.1.1-WGTHLLlFPovPck8lP79quZ0umdpa52V1EB8BRiiFEWrAcYoFxORb8uLel9vc8K8rSpRQM_lUtHXob.an7ueFG.H9B.mXXADbpmuVkS2u3DxcEwA7fwRlhgd5ctHp7QuD
.rubiconredirect.com/ 1970-01-21
16:27:58
Name: slfp
Value: eyJ1dWlkIjoiY2EwZjJkNDctMjZjNS00Zjg4LTk2MWItNDY2NGQ0YmNmMGVm%0AIiwibmFtZSI6ImZsdXhfbWFmaWFjYXNpbm8iLCJ0cyI6IjIwMjYtMDctMjEg%0AMjM6MTM6MTYgLTAzMDAifQ%3D%3D%0A
.bidr.io/ 1970-01-22
01:13:20
Name: bito
Value: AAB0c07UwE4AAAA0artE0g
.bidr.io/ 1970-01-22
01:13:19
Name: bitoIsSecure
Value: ok
mafiacasino.com/ 1970-01-21
16:27:58
Name: CookieScriptConsent
Value: {"googleconsentmap":{"ad_storage":"targeting","analytics_storage":"performance","ad_user_data":"targeting","ad_personalization":"targeting"}}
.rfihub.com/ 1969-12-31
23:59:59
Name: ruds
Value: H4sIAAAAAAAA_-MSsjQ3MDA2NjIwMTEwMjMysbQwEuIz1C1xcwpPisx1NUwszwEAUKmDdiQAAAA
.rfihub.com/ 1970-01-22
01:06:22
Name: rud
Value: H4sIAAAAAAAA_-MSsjQ3MDA2NjIwMTEwMjMysbQwEuIz1C1xcwpPisx1NUwszwEAUKmDdiQAAAA
.criteo.com/ 1970-01-22
01:06:22
Name: uid
Value: 2345a157-7658-4773-a985-c723b600e168
.adform.net/ 1970-01-21
16:29:24
Name: C
Value: 1
.adform.net/ 1970-01-21
17:11:10
Name: uid
Value: 1900642661338238831
.adform.net/ 1970-01-21
15:46:12
Name: CM
Value: 1%7C1
.casalemedia.com/ 1970-01-22
00:30:22
Name: CMID
Value: amAnPdHM6ywAOaR3AC9jigAA
.casalemedia.com/ 1970-01-21
17:54:22
Name: CMPS
Value: 6021
.casalemedia.com/ 1970-01-21
17:54:22
Name: CMPRO
Value: 6021
.mafiacasino.com/ 1970-01-22
01:14:10
Name: cto_bundle
Value: hmfDYV9WcURpeDhZNVZUQU9vZFJqMmROSHdnRk91V0N1Z0JDVHNHWVNTOFZsbVE2WmJFVTJCejU4Q2w5ODFsU2Vyb1lBQ3RqU0JIZVEyUDMyJTJGUEtlNyUyQnZ1YlN5eVZFUFNxSDhRYldwN0cwamxKUG5SYWlROWNxZ3ZGNndka0lVSzNGTmxXa2V3a3RSdGZXcTl3cUJiQUNmZ1pBJTNEJTNE
.mafiacasino.com/ 1970-01-22
00:30:22
Name: _hjSessionUser_6463121
Value: eyJpZCI6IjhjZGJiZTA0LTdhNTgtNTgyMC1iYzQ1LTk3ZDUxZWFlOTZlZSIsImNyZWF0ZWQiOjE3ODQ2ODYzOTc0OTYsImV4aXN0aW5nIjpmYWxzZX0=
.rqtrk.eu/ 1970-01-21
15:54:51
Name: browser_id
Value: 1:7d60b686-a20c-4ee5-9f16-6aac8098bd39
.mafiacasino.com/ 1970-01-21
15:44:48
Name: _hjSession_6463121
Value: eyJpZCI6ImI1OWZkNWQyLTM0MjktNGU0My05Y2IzLTY5YTY3NzNlM2MzYiIsImMiOjE3ODQ2ODYzOTc0OTgsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.adnxs.com/ 1970-01-21
17:54:22
Name: XANDR_PANID
Value: bc9EE3RZa6FY7eYvD5rLmqzEcCcu-AKtHWJcyM5cTM7dLY8wRLpa2X6wBmVva1PRAdJGzSwQqsQbYxH1T08sqSYmHxrCIAMYfki-m3WJ-_c.
.adnxs.com/ 1970-01-21
17:54:22
Name: uuid2
Value: 616405946471127822
.pubmatic.com/ 1970-01-21
17:54:22
Name: KRTBCOOKIE_18
Value: 22947-970033204402624982&KRTB&23796-970033204402624982&KRTB&23920-970033204402624982&KRTB&23971-970033204402624982
.demdex.net/ 1970-01-21
20:03:58
Name: demdex
Value: 34890661687262767462851519540925295226
.media.net/ 1970-01-22
00:30:22
Name: visitor-id
Value: 4276879975646800000V10
.media.net/ 1970-01-22
00:28:55
Name: data-rk
Value: 970033204402624982~~3
.liadm.com/ 1970-01-22
01:20:46
Name: lidid
Value: f539a137-8130-4240-8ed0-5ffc143770ff
.rezync.com/ 1970-01-22
01:06:22
Name: zync-uuid
Value: 88bfb23d-c3da-4acd-816c-02921b03f189:1784686397.5241072
.dpm.demdex.net/ 1970-01-21
20:03:58
Name: dpm
Value: 34890661687262767462851519540925295226
.doubleclick.net/ 1970-01-22
01:20:46
Name: IDE
Value: AHWqTUk44qoUdvVGXDumXvOL7hWjzbZWvpkH9-cYlMrpGl9aVHc8_GeIP3zgqWou9YA
.mafiacasino.com/ 1970-01-22
00:30:22
Name: datadome
Value: GtsDzxQsBeDtDnfMTmS6UwEboLSCgjSFMAzysy5miQFDy1ILf974MZq7lE7hXI8WioF4j~O57Iqh42c8MbdiB8ExWM9bd04nOPPvqEMhcFjBkqtwmiyXq6hOgSkhSJnt
.sportradarserving.com/ 1970-01-22
00:28:55
Name: zuuid
Value: faecac79-d534-4812-a6bb-ea036e742c6a
.sportradarserving.com/ 1970-01-22
00:28:55
Name: c
Value: 1784686397
.sportradarserving.com/ 1970-01-22
00:28:55
Name: zuuid_lu
Value: 1784686397
.adform.net/ 1970-01-21
16:04:55
Name: CM14
Value: 1784772797_1784686397_1784686397_1_Hu7u4e4e4R4eAeAREREeEREREADg
.pubmatic.com/ 1970-01-21
16:27:58
Name: KRTBCOOKIE_391
Value: 22924-1900642661338238831&KRTB&23231-1900642661338238831&KRTB&23263-1900642661338238831&KRTB&23481-1900642661338238831
.pubmatic.com/ 1970-01-21
16:27:58
Name: PugT
Value: 1784686398
.sportradarserving.com/ 1970-01-22
00:28:55
Name: zuuid_k
Value: 1
.sportradarserving.com/ 1970-01-22
00:28:55
Name: zuuid_k_lu
Value: 1784686397
.sportradarserving.com/ 1970-01-22
00:28:55
Name: bss
Value: !bidswitch=553943597
.sportradarserving.com/ 1970-01-22
00:28:55
Name: cm2
Value: !bidswitch=554015597
.eyeota.net/ 1970-01-22
00:30:22
Name: mako_uid
Value: 19f87994a9e-11550000010a59fa
.bidswitch.net/ 1970-01-22
00:30:22
Name: tuuid
Value: 5c7324c3-bfde-42fe-9aab-48b387228531
.bidswitch.net/ 1970-01-22
00:30:22
Name: c
Value: 1784686398
.bidswitch.net/ 1970-01-22
00:30:22
Name: tuuid_lu
Value: 1784686398
.eyeota.net/ 1970-01-21
15:44:46
Name: SERVERID
Value: 23034~DM
exchange.mediavine.com/ 1970-01-21
16:04:56
Name: criteo
Value: %7B%22id%22%3A%22k-WMf1mEeroCOCSUKVjb8zA1-5feb4JqVK3DVBhQ%22%2C%22version%22%3A%22criteo%22%7D
exchange.mediavine.com/ 1970-01-21
16:04:56
Name: am_tokens
Value: %7B%22mv_uuid%22%3A%22e792e4c6-8572-11f1-8000-0123456789ab%22%2C%22version%22%3A%22invalidate-verizon-pushes%22%7D
exchange.mediavine.com/ 1970-01-21
16:04:56
Name: am_tokens_invalidate-verizon-pushes
Value: %7B%22mv_uuid%22%3A%22e792e4c6-8572-11f1-8000-0123456789ab%22%2C%22version%22%3A%22invalidate-verizon-pushes%22%7D
.exelator.com/ 1970-01-21
18:37:34
Name: EE
Value: "fcf9b621c5b9d8448a702b200ee3272b"
.exelator.com/ 1970-01-21
18:37:34
Name: ud
Value: "eJxrXxzq6XKLQSEtOc0yyczIMNk0yTLFwsTEItHcwCjJyMAgNdXYyNwoaXFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDUYEl%252BUWb6ImfHxUUpaQyLSopPBZ8%252FfBYApqgq5w%253D%253D"
.pubmatic.com/ 1970-01-21
17:54:22
Name: KRTBCOOKIE_466
Value: 16530-1254a2ec-5c6d-429f-9422-1000d186be0e&KRTB&23280-1254a2ec-5c6d-429f-9422-1000d186be0e&KRTB&24016-1254a2ec-5c6d-429f-9422-1000d186be0e
.postrelease.com/ 1970-01-22
00:30:22
Name: visitor
Value: 1c81816d-6a19-4005-bff2-b305eed9c6ee
.postrelease.com/ 1970-01-22
00:30:22
Name: status
Value: 0
event.iconvert.network/ 1970-01-22
00:30:22
Name: sp
Value: 8de95e13-422b-4c33-a067-22eea1ffc4cd
.csync.loopme.me/ 1970-01-21
17:54:22
Name: viewer_token
Value: ba9a5f68-91ac-4554-a994-c958ea0adecc
.bing.com/ 1970-01-22
01:06:22
Name: MUID
Value: 03C901A07533657A362B163E74F864F7
.c.bing.com/ 1970-01-21
15:54:51
Name: MR
Value: 0
.revcontent.com/ 1970-01-21
16:27:58
Name: v1_151
Value: 1
.revcontent.com/ 1970-01-21
16:27:58
Name: v2_151
Value: k--ZMlRUeroCOCSUKVjb8zA1-5feYM0gDa56cncA
.rubiconproject.com/ 1970-01-21
17:54:22
Name: receive-cookie-deprecation
Value: 1
.smartadserver.com/ 1970-01-21
17:54:22
Name: pid
Value: 6482862348005197118
.smartadserver.com/ 1970-01-22
01:15:00
Name: TestIfCookieP
Value: ok
.smartadserver.com/ 1970-01-21
16:27:58
Name: csync
Value: 79:k-i1W4VUeroCOCSUKVjb8zA1-5fea_kKP_6CuPYA
.adnxs.com/ 1970-01-21
17:54:22
Name: anj
Value: dTM7k!M40*f5$P.ghqdmU(7TUWEt0U!]tb=J.Pbe!k+^y''!)TaYkA>_(xXtQ4Pj[SgttlSmklu'DBes*u(wb`T>GwI]@`l+Eso3*s%i3+F5qy+0c5`+`gvf[aRTXSBBmHfSYlthm+9z=jJQ6u60zZtfb2?_Hdj$j5=ws>!3S02u:Y6gy2@S)OCFK*ZlXz>wL5L!!#H@1N6_D
.360yield.com/ 1970-01-21
17:54:22
Name: tuuid
Value: f5719fea-5905-42f1-8a36-302e0792e85d
.teads.tv/ 1970-01-22
00:28:56
Name: tt_viewer
Value: 1f299c98-c02b-4dce-9212-4127bc60a735
.seadform.net/ 1970-01-21
17:11:10
Name: uid
Value: 1900642661338238831
.media.net/ 1970-01-21
16:27:58
Name: data-c
Value: k-pypeLEeroCOCSUKVjb8zA1-5feYUNB0JF_UGKQ~~3
.mediawallahscript.com/ 1970-01-22
01:20:46
Name: mCookie
Value: e98799a0-8572-11f1-b113-dfaa3451232d
.mediawallahscript.com/ 1970-01-22
01:20:46
Name: mUserCookie
Value: %7B%7D
.pubmatic.com/ 1970-01-22
00:30:22
Name: KADUSERCOOKIE
Value: 78F3360B-B494-42EF-A045-0FFACEB7E57E
.crwdcntrl.net/ 1970-01-21
22:13:33
Name: _cc_dc
Value: 0
.crwdcntrl.net/ 1970-01-21
22:13:33
Name: _cc_id
Value: 2a5f709bd66dacd324be0b5da191e7e6
.postrelease.com/ 1970-01-22
00:30:22
Name: ver
Value: 1
.tremorhub.com/ 1970-01-21
16:27:58
Name: tv_UICR
Value: k-k0vmVkeroCOCSUKVjb8zA1-5feY21DF-jUOl8Q
.tremorhub.com/ 1970-01-22
00:30:43
Name: tvid
Value: 3bef0326bb09442cab288f270c213fee
.rubiconproject.com/ 1970-01-22
00:30:22
Name: khaos
Value: MRVG7CTP-O-8DUY
.rubiconproject.com/ 1970-01-22
00:30:22
Name: khaos_p
Value: MRVG7CTP-O-8DUY
.rfihub.com/ 1970-01-22
01:06:22
Name: eud
Value: H4sIAAAAAAAA_13OsQ0CMQwFUIGgQlSpGCIodkzssM0l0Q1EmfJKypSMwAiUlIxARYXALp--_L_7ag8slCTFzEA8jG_Gd-OX8dt4WWtfjYfNN9qPf5Pg2Jr_dtoXxyJlLhibr7FNnqbavECqPmBGKCHOIPn8OzqekCAwdvdtogCCYTF-Or3UD9ofRo28MEoBAAA
.rfihub.com/ 1969-12-31
23:59:59
Name: euds
Value: H4sIAAAAAAAA_wXByxGAMAgFwIvt4PATHnaTwKQQK3f3uxLYZ6sNtc0iXz0EiSbWUtlsR1CvJDwQVnk_6sKpP73j9Lg6AAAA
.taboola.com/ 1970-01-22
00:30:22
Name: t_gid
Value: rtbh-90c911ff-9159-419e-97a2-07638a36c3b1-tuct1159acc1
.taboola.com/ 1970-01-22
00:30:22
Name: t_pt_gid
Value: rtbh-90c911ff-9159-419e-97a2-07638a36c3b1-tuct1159acc1
.1rx.io/ 1970-01-22
00:30:22
Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-431cf1de-8952-4768-bb0f-768478c0a626-005%22%7D
.rlcdn.com/ 1970-01-22
00:30:22
Name: rlas3
Value: 9qyvRhgjDIvxtuK/v9KOo+agcFXza8um+x/fCOCdTsk=
.rlcdn.com/ 1970-01-21
17:11:10
Name: pxrc
Value: CMHOgNMGEgUI6AcQABIFCOhHEAASBgi66gEQAQ==
.3lift.com/ 1970-01-21
17:54:22
Name: tluid
Value: 2030916402358250828386
.pubmatic.com/ 1970-01-21
16:27:58
Name: SPugT
Value: 1784686403
.360yield.com/ 1970-01-21
17:54:22
Name: tuuid_lu
Value: 1784686403
.360yield.com/ 1970-01-21
17:54:22
Name: um
Value: !42,w2BX.ihyp18EFgXyK27p4hloXKLJu51gjLTlDfBVO8mQwsg-ZmZZsITVXTASWEUU7ZII3A,1785895997!191,8FT7.NLQqJI5nMBlXfsDSNvKIx0tKmzuXd9yobmHvZ6yFrCC.D8msz0nN2GlWM9DS5uO0RAwEiPZkFwlqW4-EX5Oeng,1792462401!38,ZwwXHJ0gV2tK0aMfeNx30AlFKCY1crvnxeZa1cIlJ17fvpXSkJIIb.p2CCYj.ZSEdyCjrcHlzMrfPrhbEtMuDKrYYl4,1792462403
.360yield.com/ 1970-01-21
17:54:22
Name: umeh
Value: !42,0,1847758399,-1!191,0,1847758401,-1!38,0,1847758403,-1
.media.net/ 1970-01-21
16:27:58
Name: data-c-ts
Value: 1784686403
.criteo.com/ 1970-01-22
01:06:22
Name: cto_bundle
Value: KkIFK19ObWhxajBBZmJiMkNqY05xVWo4aTRwSFA4dVQ4MElWNTZEY09YamRyck0zZmh4aHRCQXBTSFFEY0RoOFNKM2FqY0pZc0FzMnBOVXF4QkhkdEQlMkJpWVhtVjdUaTJKMnklMkZ3dXVvaWhZQTRMa3JEd0l5ZkklMkZqWUpqRHNSaGJla2tKTkJERE9jTFd4d2RrTGxyOVp1NHlDZWclM0QlM0Q
sync.srv.stackadapt.com/ 1970-01-22
00:30:22
Name: sa-user-id
Value: s%3A0-f453498f-a41e-51d9-4aa7-43b1ea6ef526.UmpXe%2BbP4p3QEy3OKZA4QV3bCvHb1g0nil%2BIjgP98Y4
.srv.stackadapt.com/ 1970-01-22
00:30:22
Name: sa-user-id
Value: s%3A0-f453498f-a41e-51d9-4aa7-43b1ea6ef526.UmpXe%2BbP4p3QEy3OKZA4QV3bCvHb1g0nil%2BIjgP98Y4
sync.srv.stackadapt.com/ 1970-01-22
00:30:22
Name: sa-user-id-v2
Value: s%3A9FNJj6QeUdlKp0Ox6m71JpovESo.Jdj0%2BTOeSgJbvtB%2BvE1udu%2FPj0J%2FrlpTZygYhs%2BVJjw
.srv.stackadapt.com/ 1970-01-22
00:30:22
Name: sa-user-id-v2
Value: s%3A9FNJj6QeUdlKp0Ox6m71JpovESo.Jdj0%2BTOeSgJbvtB%2BvE1udu%2FPj0J%2FrlpTZygYhs%2BVJjw
sync.srv.stackadapt.com/ 1970-01-22
00:30:22
Name: sa-user-id-v3
Value: s%3AAQAKIAPLjQgSX6_zfLhidvu-3cOM3ATqlKPLilBxM52G7rLiEAEYAyDDzoDTBjABOgT6tMeSQgTb_xu-.4yx3myF9PTNLu9GeeIWGUq4N30RHNhXjMllwOYn4bN8
.srv.stackadapt.com/ 1970-01-22
00:30:22
Name: sa-user-id-v3
Value: s%3AAQAKIAPLjQgSX6_zfLhidvu-3cOM3ATqlKPLilBxM52G7rLiEAEYAyDDzoDTBjABOgT6tMeSQgTb_xu-.4yx3myF9PTNLu9GeeIWGUq4N30RHNhXjMllwOYn4bN8
.adsrvr.org/ 1970-01-22
00:30:22
Name: TDID
Value: 7e81865b-5609-4081-ac6d-6aa472eb1942
live.rezync.com/ 1970-01-22
01:06:22
Name: sd-session-id
Value: .eJwNzE0OwiAQQOG7zLqYYRhh4DINf02IFk2pGxvvLsuXfHkXrO967LHXfkI4j09dID_brAHhgtG-e31AAO8QjSFkRrLEXgh-C4w6Rnv1tZVJRNKWyBSVTYmKYy5KtM0KyZNOaDYtPmgnbMUa7253Yo1ufv6c-CWL.amAnQw.Ri4dKpC3LkrMxJhFNCw3Lm-EiX8
.adsrvr.org/ 1970-01-22
00:30:22
Name: TDCPM
Value: CAEYBSADKAIyCwi67rmeseizPxAFOAE.
.rubiconproject.com/ 1970-01-22
00:30:22
Name: audit_p
Value: 1|tpvsxbioNKJ44WHBwinEzsRe1sr5gcLfIINMi/r7Fs26DKtRtV0ye1GhKzNuEn2r1QX/qB+lrq7yUhTWCqUS/I+whRf0v/l/YvnFPsQkkN7J81Hcoqqcvo4yVLDHBCJUfY0V14FIbwNDA6MeUnKE5KZr5ZVxLWDe
.rubiconproject.com/ 1970-01-22
00:30:22
Name: audit
Value: 1|tpvsxbioNKJ44WHBwinEzsRe1sr5gcLfIINMi/r7Fs26DKtRtV0ye1GhKzNuEn2r1QX/qB+lrq7yUhTWCqUS/I+whRf0v/l/YvnFPsQkkN7J81Hcoqqcvo4yVLDHBCJUfY0V14FIbwNDA6MeUnKE5KZr5ZVxLWDe
.linkedin.com/ 1970-01-21
17:54:22
Name: li_sugr
Value: cfb0fa39-291c-476e-b645-97021b8d8ea2
.linkedin.com/ 1970-01-22
00:30:22
Name: bcookie
Value: "v=2&40a29b3b-9036-4eb6-8ee7-c407746a3a3a"
.linkedin.com/ 1970-01-21
15:46:12
Name: lidc
Value: "b=OGST06:s=O:r=O:a=O:p=O:g=3563:u=1:x=1:i=1784686404:t=1784772804:v=2:sig=AQGW5KKnAuyo25COLiX5UQ0bRZezg2Sf"
.linkedin.com/ 1970-01-21
15:44:48
Name: __cf_bm
Value: XY.OS6HhKW43fWvzPNOIOHxrSkgnrP9p_0R36IuRcVw-1784686403.9907455-1.0.1.1-oN8v_cv0VsZTkjcerVYyaBdSSCeblvy3h93_DPl2QXz7vfPY5QfVJjnntslCAv4L09g6XX7YpgmALLYQJiTSzXERAhFKPc.n.7L03FewttZqbBiqHPj1.GwZEsdEQQfl
.tapad.com/ 1970-01-21
17:11:10
Name: TapAd_TS
Value: 1784686404237
.tapad.com/ 1970-01-21
17:11:10
Name: TapAd_DID
Value: c925d154-c88f-4722-b9ea-c1168b8d947d
.mafiacasino.com/ 1970-01-21
15:44:48
Name: _sp_srt_ses.1154
Value: *
.mafiacasino.com/ 1970-01-22
01:20:46
Name: _sp_srt_id.1154
Value: 5ad6bccb-e250-461f-9b11-9dcbbb89cd79.1784686404.1.1784686404..42c359f1-7c07-42dc-9fa8-3ff6304f7ba3....0
.tapad.com/ 1970-01-21
17:11:10
Name: TapAd_3WAY_SYNCS
Value:
.lijit.com/ 1970-01-22
00:30:22
Name: ljt_reader
Value: NCpF0LZHAZ-HmWd_YGByZAVw
.targeting.unrulymedia.com/ 1970-01-22
00:30:22
Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-431cf1de-8952-4768-bb0f-768478c0a626-005%22%7D
.mathtag.com/ 1970-01-22
01:10:41
Name: uuid
Value: 3c956a60-2746-4c00-b354-e6273e36baed
.mediawallahscript.com/ 1970-01-21
15:46:12
Name: mRemnantVisitedCookie_d41d8cd98f00b204e9800998ecf8427e_07_2026
Value: %7B%22ZNLJs2%22%3A1%7D
.pippio.com/ 1970-01-22
00:30:22
Name: did
Value: 8-5gAKny1L_PWOHW
.pippio.com/ 1970-01-22
00:30:22
Name: didts
Value: 1784686408
.pippio.com/ 1970-01-21
17:11:10
Name: nnls
Value:
.pippio.com/ 1970-01-21
17:11:10
Name: pxrc
Value: CAA=

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
rendering warning URL: https://mafiacasino.com/login
Message:
[]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering warning URL: https://mafiacasino.com/login
Message:
[]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering warning URL: https://mafiacasino.com/login
Message:
[]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering warning URL: https://mafiacasino.com/ca/login
Message:
[]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering warning URL: https://mafiacasino.com/ca/login
Message:
[]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering warning URL: https://mafiacasino.com/ca/login
Message:
[]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network error URL: https://event.getblue.io/js/blue-tag.min.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://mafiacasino.com/ca/api/v3/seo/item?page=login
Message:
Failed to load resource: the server responded with a status of 404 ()
rendering warning URL: https://mafiacasino.com/ca/login
Message:
[]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0425ce576b70653b18f084f63cc38c29.seondnsresolve.com
20874641p.rfihub.com
409423117828234e774a05c21da2005b.seondnsresolve.com
a.audrte.com
a.rfihub.com
a.sportradarserving.com
a1.adform.net
a1.seadform.net
aa.agkn.com
ad.360yield.com
ad.yieldlab.net
ade.clmbtech.com
ap.lijit.com
b1sync.zemanta.com
bpi.rtactivate.com
c.bing.com
c1.adform.net
c1.rfihub.net
cdn.cookie-script.com
cdn.iconvert.network
cdn.seondf.com
challenges.cloudflare.com
cm.g.doubleclick.net
connect.facebook.net
contextual.media.net
cookie-matching.mediarithmics.com
criteo-partners.tremorhub.com
criteo-sync.teads.tv
cs.media.net
csync.loopme.me
dis.criteo.com
dpm.demdex.net
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
dynamic.criteo.com
eb2.3lift.com
eb6a7d55b667d9b6e52e2ebe363274d7b395eb78.seondnsresolve.com
eu-u.openx.net
event.getblue.io
event.iconvert.network
exchange.mediavine.com
fonts.gstatic.com
gum.criteo.com
i.liadm.com
i6.liadm.com
ib.adnxs.com
id5-sync.com
idsync.rlcdn.com
ih.adscale.de
image2.pubmatic.com
image6.pubmatic.com
jadserve.postrelease.com
live.rezync.com
load77.exelator.com
loadm.exelator.com
mafiacasino.com
match.adsrvr.org
match.contentexchange.me
match.prod.bidr.io
oafiaca5inuo.com
obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com
onetag-sys.com
p.rfihub.com
partner.mediawallahscript.com
partners.tremorhub.com
pdw-adf.userreport.com
pippio.com
pixel.onaudience.com
pixel.rubiconproject.com
pixel.tapad.com
pm.w55c.net
ps.eyeota.net
px.ads.linkedin.com
r.casalemedia.com
redirect.frontend.weborama.fr
rtb-csync.smartadserver.com
rtg.rubiconredirect.com
s.ad.smaato.net
s2.adform.net
safe-track.pro
script.hotjar.com
scripts.rubiconredirect.com
secure.adnxs.com
segment.prod.bidr.io
simage2.pubmatic.com
simage4.pubmatic.com
sslwidget.criteo.com
static.hotjar.com
sync-t1.taboola.com
sync-tm.everesttech.net
sync.1rx.io
sync.crwdcntrl.net
sync.mathtag.com
sync.outbrain.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
sync.teads.tv
thrtle.com
tm.ads.sportradar.com
token.rubiconproject.com
tr.mafiacasino.com
track.adform.net
tracker.ads.sportradar.com
trends.revcontent.com
uipglob.semasio.net
us-u.openx.net
use.sportradarserving.com
user-sync.fwmrm.net
wt.rqtrk.eu
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
x.bidswitch.net
a.audrte.com
aa.agkn.com
ad.yieldlab.net
b1sync.zemanta.com
bpi.rtactivate.com
cookie-matching.mediarithmics.com
dsp.adfarm1.adition.com
eb2.3lift.com
event.getblue.io
id5-sync.com
idsync.rlcdn.com
mafiacasino.com
match.adsrvr.org
match.contentexchange.me
onetag-sys.com
pdw-adf.userreport.com
pixel.onaudience.com
pm.w55c.net
redirect.frontend.weborama.fr
rtb-csync.smartadserver.com
s.ad.smaato.net
sync.crwdcntrl.net
sync.teads.tv
thrtle.com
trends.revcontent.com
uipglob.semasio.net
user-sync.fwmrm.net
100.25.13.4
100.59.229.44
100.60.151.254
100.60.188.223
100.61.34.68
100.61.75.197
104.18.26.193
104.18.27.193
104.18.95.41
104.21.19.114
107.178.254.65
13.225.196.122
13.225.196.71
141.226.227.75
142.251.163.97
150.171.28.10
151.101.194.132
151.101.194.49
172.253.115.94
172.253.139.156
172.253.139.157
172.253.63.101
172.64.146.215
172.67.148.159
18.160.41.58
18.239.6.20
18.239.6.48
18.239.6.77
185.167.164.38
185.167.164.45
185.167.164.48
185.167.164.53
185.207.196.198
185.207.196.82
185.207.199.145
188.166.63.236
198.54.115.232
199.38.167.130
199.38.167.131
207.65.32.88
207.65.37.181
216.19.192.2
216.22.16.9
23.12.145.162
23.221.252.28
23.23.167.209
23.48.203.44
3.167.88.21
3.167.88.60
3.217.204.162
3.225.158.18
3.233.2.188
3.80.18.4
34.111.113.62
34.237.134.39
34.252.32.161
35.211.155.243
35.211.202.130
35.214.197.234
35.227.244.76
35.244.154.8
35.244.159.8
37.157.2.230
44.208.106.13
44.208.117.202
44.219.75.51
51.222.241.145
52.223.40.198
54.172.43.65
54.237.4.69
54.243.157.64
54.75.32.104
57.144.70.1
57.144.70.128
63.181.140.45
63.33.10.76
67.202.16.78
68.67.161.208
68.67.181.102
69.194.240.13
70.42.32.63
74.119.117.57
74.119.117.6
74.119.117.62
74.121.140.211
8.28.7.84
98.85.140.86
0241583fe0a81ffb1201b4bd1b5bba5a0088480adefd0568fedde6c38f3220e3
02556635753e610f8018141368fee00c43d46f890eae7c9d07a217bb25713ade
037bacd626e93f7b7380ee9e41aa365ccc52283dc9e62de7152f678831720a64
05ab7bc8114481df9930bf64daaf231dbc17be338bed89298ed6a2b888fe98fb
05d98b25d591227495950a3fdcd56dd150cb6bafee355ed1d25fa27253f27ce3
0dc10c4116a00d68c7d80f081ea8362a91dea4bbd73bea18e63e843fb18afe6f
1012e66fe3edac52a719e8999620861139c2059df08c6a7a2593a90873a7ad2d
1041e962a25a4980aa80a2bf9857b9305b9855419798492f624db89b1b667c55
12383ad34041629b4ee0e8c966f4864c654e4291619daca90d6725757e2d01cc
13cb887840d71fce7756287c3bf9c30461371165e824f41070552079fe7a019b
1538cd8aed8cb98c0e07603551ccab69c48f771ee3e258edd09af7c2bca0ecc7
16112ed7fd2f9600b662a0b87426711872fed4022a604a68da70cb87258aa27b
18d4940b792d3290173047ab564b5d70c58f24b6e9e194aee7be1bb109bb02d5
19700c76b7a192f1a8fac1b70bd1c565d915566bbbfd613c0846f3231edd25a5
1a3e18cff8c54c58285c75e6535932847b756833a5a4f76585bb8c3ca116aa22
1a4cc0a43d8faae77be3ef2987bbf0b952816a597a85189e4e2458abd0b057c7
1d2a05342ccb88ab243f8e6aab5e393b7c390d1c99a52aafce4d7c8bde4de25a
1d5ff1771c2cabbc3332aa44e62bacd7bc292a1e22e5e73111ac29d0c9281427
1ea544a14c010c9664d34c64ed9a973cba64a09d15e9451663d46484842efa3d
1fdd8f696eb8c0668a84ba31c96d393021cd5b68ee269c2704d3f0f47eacd8e2
20558b95c6baf40f42e0516d5d49c5f895485ad21109aefa76b0092f48311756
215a93c696f442034a46fbb382958f753fda60e30490683aeea6b235fcbb2b66
2176b732b7e4e2bf32a38335a1ee0a127efef2478266d3ec2ed806edaf9671a8
2515494e8cc2ca07c86ea78766cfa104b796aa6ed5d66821c01d51dbb0b52bce
2522e3f24f318e5c2d998482e9dbb933566aa4eb8b55bccbfff48c91505d27ba
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
272bafc1206bce355050e8b8289f1dbd9b031974bc18de4d16b991309a827821
28ea305fc2a4110819b9eebf8cd9c558dbdc013ef205f6d3c653ecf89ee3e1a8
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2d797dd8b35dcb3413e1af9d7052b3f4f8c341a147cdcb01f4f06af80db53289
2d7a270c1928be61476bfe7e9a662b5d23101783e646e0b241b3955ad5ee786f
2e1855d1eb4e8c77c9334507c0fa2036b3951912cb239220384f4cae3c4af4f6
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2f63d4b6a21cb85222673d043c0c4a644eca379e40f808af4cd2a53cc16da0f1
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
33029abbea89c1de8f74db1d2a33891e1dbab78f8a0eb67176ecf737597aa244
35200ef43ce26ee8103bd83e1224810c485ee94a7e74c5f3537344e6554f846e
3663d58af24be6aa25d0476aa089d190be6aa0de6c360431fb9ddd63d573f0a2
36813feadf12ddf91e71ca2baa4fb8e842a231af2dbd7ba4524ed58943bba533
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
36ce068a4107077cee7072231c246281cd2a208444ed215337b5c3f4ec1b9a3e
3787a5a419171630e6890cfa47c4da067474d005cd0ff8dc11ec090fdc3ee2b8
3932e3ba6d0d63461a546aa76034e374014f4148120b8d8dab55c3ca80602871
3a6723868cf05bf520ff3b8913f1bf214b1ed20f95e34e21b8bc9586b99ea8f7
3ba52493e38d6662407c5aabcd7c982e92070e2a5eaa85348756bcb82b5aa6e6
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3ef28a40c85699c2cb3afd8ba17113a35b2de8357e8215bf4782dde20636d8f7
3f7d9d5a786b0591ac59dc2c74cbd1ef298a72f91d74868243c9a446b9bca5c6
4037f4299bda5be7a68f138f5f18fc810bd3fdd6856b1ded6689e9d2c2dd756c
43c04904bc016a888a3597c171ee033c10ebf398a8d499d239f7565ac689432a
460f141ec8f6c9a1516bfd2bd9fe71656246d7a9d04a0955faf53158d8970c4c
461041dc2d19bd05017eb59c4612f98834b1ada2bbac2d4683273702dd74c524
4657c89a3ac28f9a49306c904194ade79dc2c2833c3ef0f884f32dd98baebfba
47029363167ece75cffaa763455ff8cfecf9a5514c0233c36f42cc17484bf037
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
47135c097ef78fb93c3988aab703004596401225226ef9a33ac93c0a2432bf09
4a30c50595cddc4c4bcb7c893321b11795a045326f35f913500ec56bcc83ea96
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bddd1578e1f5814c17aadd04b0ee3993e0e3cc22c810d26d4a20f5603b71066
4c0443d7e9bc0849364b498e8a0acbbafbfd21e69c504b145540df43c3828596
4c9c2adcea0d682be64b984be4680966682da253f1fd0048bc10a7e7a55d6edf
4ca010c8509157ddcca054ae1cad78d04d6478897abf8dd484e4b4628893eee6
4da0b1082d27045b3fd511627ef8708b5c3bcce46e17cb4f55f08483142d1e3d
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f1a408efd85a4ed4f0d9afe31554dc5bd4f12a2d34ad5f8fe9e4559a4ba7a04
4ff3166c3b5b941a47c6de204946b659e38310e64f22bb46cfa40cb451ce5b00
52efcec1516195a656f9887e5942a67576916af3ed1cfa0d3a660b78fef073f2
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
572409c309c86fc1ff9a5806ce5e9034e232d49bb15f41ed931e7d0e9f28bed6
588f6ae9581dc35afdcf5b69b85071f8e25f45ce63ce7c8810fed3de486508db
59938868870ce60b8576506d0211346d8a85329a9d54997c39d921389c493b34
5c5c445b67e1cb710a98338a2ee3631506a50351a355c9cbcf455c8fc48a21f6
5cee0bf7ca742032db248e1fb26e4634e9558479101e612a78efa189d026960f
5d9e8cfd13ab9f3cb184ee716c93c4c007837b001ab17f762269a64b2d8958cc
66f48e1eb1bc300b737ada04d243733c151e15fdda33f30e34b4fab002e72bed
673f2535bc8ab34817604b9df7d471f020ed2a198bde1a4754bb044f8a530f0f
6a1e6df2926c23830dccb587abf97e0a22f0e03ca25ab74b4ce925839ede585e
6a95037c18c2d68bc331a41a435642fedf969010ad12aeb59b0538f9ae85c73a
6ae4b6dcd481ec6811e88ca843dda54177ca87c90ffa789bb9dd922bb1494109
6e3d31a792ff5461323d1b24eeb360acef26a2b70f40ee73f1898f63c1abcc29
6ee1ee2d4ba92b18886f948724bd0c018ec2fb4881bc50f85217487747047ce5
6f5d995ccc4d8ffd9e8cb4c303fc1f3646d6c62d40269ef59463332f12d5b897
712ce9adf207f90032a74e04f2ffc8dbb9ba3a1be016e8a4a08a2da59ce4a34d
7234b6a4fc50d44b4a457e296d017041ddeae609f1c8a05261a8a1686428a205
72f4c78c3eade56494d1599f29110a718938c8fecf3b3093170ad3490fe74aa6
7378ee4f754c282196e97ca36adad82f4fc576251bb430f0a49c6779211c460d
783546fda73e86865d4848a76a2ad5678bb693ad767be36dc490ebc42d005cbf
78a334f23967c38d03a96335cde0420f71ff3001f504de93214e4909ccd66f44
79e0c0225f8dfd655ee5fb7580646260339739ff8e131d4b1ec90bc267e4b60b
7d8ab42bffa2b5e2e847eeb271185006847dcadb34cd1b6843443f8f14d61b2f
7e83e939730459875a6b87231062c40e96889d2715c0427ec1bd3a341b1cd74e
7f0dd5cf2e5b0c4d56b51666966cd33b59eb7e4ef8fe60647dfd0f53d0bf789c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83ad68484efd2672d61bd21a11fb2b44d085f22b31aef56e7a8852fe718a70a2
8544fd687b99eb9e3f1104f315dfe557b49bb3440e1ad50f9afe6adada2032b9
85d8fb5443796e173ef63b5dedd76e83d6d6c9ee1331f20f446f34938670c72e
87a06d50a2e60f0f2fa9957322630c869ea00dfc13b6d462a7967bb3ffb0cffc
886164eda6172a0c7895cb70324e60124b941b96e9e935ee61fa497a8bc0d9f5
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8d897f4bddeb5b73472b17d287efd255a745c5117b0c36a16c6d7036911a6e9a
8dbeacacee80b72b9b83400adfcc6df9302d91e4536866afc1359d13860aa737
8e6959ab01c9015d667175c58c8f21608c86f1204fe60e8b6723efebfb8a25cf
9206470d3680b8ba127cc6ea121f9d89362c85f12fb6197889fe62ec99a953ee
92ae7c416ebb796f7c50f9218b240df3aaefd79f652ec2bcbd81b4aa7b261e17
93cd5bf9a9825c02400b3efda66019407e773cc8a8681e7029abdbc81b5d58a1
96317501ab9492f9066e5623d7e87c6012ee8c15435feb319acaed207c4195f4
96c18febc49ca283a3897d45f0fc6d9cc5e52b40bf8b363087acbba352c6c912
98ff19a40ff9102c81effad0207416315c5c7808fac5d7414ca1ba780cc131d1
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a8192ce9cd6f8d16c2067c497993055b98be0254f2c92130be08d832f00c330
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a557e5f7ae0fdd7e0c9c124b6bdb2288ee2d293ae1d7238ab4f9ba3650593282
a6cbda300a5e48a41a22961afe76b5775d75471b31edb4c5b05d0deae04da660
a72e4ed95aa5c261bc587d6f4f7a3dd5c2c13a88f071fbe0cb7282830365734c
a8c000eddd9ddf22529f49d73f09f6dc1bb438017730d2c9a39aa9ce83d1e1d2
a98e85fbae805ef71739d57dbf852a5d7aaf4e1773541718b49085038c2c95d6
aa01966de3f608a765a172237a3ffc6161fe4c7e3870b1a904dc6437e54c4e24
ab8de565af362b46fe9fcdcebaeb21cea243d711bdd45a2e7e34aed6c1e1915d
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
b0a8ad37ac45f5fb22ced461576db72e44e295107aad7a9c8a7a4bad728fd03b
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b15a96b60dc8023156615199897a531847b0ad4a3982ae4c6d51be2189215d17
b1dd91cfa6ea0b73f3c7e496140cb7fc515fb94b365786d3184a23af58afddec
b21d5d110909d367da628482cb81e8faf99a9818df980cfaceaf3fa511b3af70
b23e66d4069b18ef616d8fad61aeaabba80fa8cd62e75d0b3d0d08758ac14e6d
b2e7c251a01c676b992acb20133ef377bd55aa22e56450abf78486c823ee403c
b342b8dd693993977cbcd3c2e034dad0497622bdb06325f2015c29cc0e7c4d64
b364b2c4553345b925b7777c12f57761169c4f73d4246295fe62313f994dd419
b5d79b19776f7c1dfca14d87cba9372208a33d9c286a23355ac0f038f73aaff5
b9de52c7b623e9b7ad24ed35df2b243d290eb6df336fba90ed990c5bac8e16d9
ba0b3454d097bda80fdec5c9b264bb4f34a9cbd9dc5d6c00d54230b7bb73143c
babab4af8cd2e6d6d813e03132cba7701e833669f638c1720d5524f98d127460
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bcd8761987e21cf2ccf4d91ad22c5c64c675e2d4976ec05281ab142348af1f39
bdcfff76b1a267221f3557b2eeb6b4b28f87eceefae0e25f328ef63c0cb1778f
c091ee830bf4d125b2bdba1718cd9d690e830b10026ad7ee81cf77c51f741901
c29326c96dc78662cf650d385a95abd53d7a34ccd629d71b07a08f7865f639be
c4ba703ca952cd992cc9a4e833020bab9ddd3b627e0af264ca0c86f1dddd6938
c737a609535bd63a86737bdf1b2a1122da357cfdfd293034a8f9fa300134f567
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
ce7e0cb4bcf9bcb2ff9192615a7f5464dba839d94e69c2b431a373152bf0e8e3
cecc334b018bf8f81b484b503088a903e26dfa83f4a0bb20ae57f06ea718d18e
cf2ba67b465dfc2147433138a40ddcffe330c6cfb8f49bdb49669b38605a6af7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfc2c295ce468089482403d6ca67d3828a36623650a9bb10aa656c3e33b4a1b5
d0594a9e7f8f4a4cb964e91fc2692820319bbc2b5c05b00f61fc6f28619703aa
d0662790d9faeb32a860d9d8528b8dd809478ff31fcf48337184a766298c7ca1
d3b456fbbc69a430a8163b6e37c73def04571e40264646bddce444f04e6cf1fb
d62dda9559c8add641c3ae9fa2852e272a6ab5f54e930c0f0eff5e46402b077a
d64f9c4b2b02a9bbad5c0189d6bd998983685d7b1043166807b936f30c701e6a
d7d635822b264fd3459bb6a7179593be0e56b23f115e79ccbe3923e168186901
d8c73dabf8061fb453287eddb84bc1dcd34d3db41c50938f232231bf9a9ae191
da8456f776cc1aea7ff4f1e85f98a9a8b176afa8eddfe481e6b2a35081a79599
dc8eadf5c7cd2319dcbcbd609bd96f3e172d237968c79a8638f96b6339ba65e6
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
dfdcc690dbe70f99a2f452eb04f8a31bc34d6872cf14059854ff8e4f876d86ad
e15f91305495a6b6ce8cb22e5f829e9f85189cf6e797686dd8b3a17f1b6a7409
e2f0eaebb9f1a2c9dee387266af5aa705daee896371669046479f9d2bd29f622
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e451c1a59800168b5da0128c2ab78676d773ad360b6077b0337b0e93f59b3467
e468fdf96d4f486bb4831e232c8c7acdcaa2005c35b0c23e26bcdac2c9bd6623
e4e656b0f6c4b2bde0d8035cb24d46cee8cf18dcb457895be96e6120d119a662
e677926a3508b947ed8a76bedca3df32f6e4ca4882371c4571af6201b986c418
e8121bc993a627083bd3064aadd3cbd53f463c92d292661d83029e65893c5754
ea6039f470a15f3c57fc320f5a0683ec41a0d42982e0a26bbbdda68a4a4c9918
ea99c0a9cefa49b6d0e2ec4898b7ac2b26e01d9ccf80faecd0de04ad28e6e701
eeef2227a890fc04646e3ea1c872a8c28799ffbcb3e402fbb64f2eaa76dec2dc
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1bc6367f745923470831c645e19f648616fe0ec1a86ee66363c3b7851e945e6
f57c222d9765c4e31a08e4b06b62bb7275945afcd799c8c441c7fe6a21efee88
f70b370debd085dd9e9fb6495c796cdccf41c44574cc185dbe124f3ea8237623
f8adb1845d2f8a3121bf5fd9bca711bcfe5d13374b4e4b19d4e694bfb1604240
f913ced1f2a6a1103c58417e729e568ec42e8e01ac9f6873053b2a26a34737f3
fa3c57ad94c6f5ce1eac453fff8ec1ae3fb8094ff9f0259b1291e07b09b58aef
fb49e916c1ab7e8b473309bb7acce514e992e807c1fa0ad4187963adae690d5f
fd3c5e781df25f157c4f01d214c7befe4429f6840a172f1a7e49e61dfc37d952