www.financialhealth.net Open in urlscan Pro
2606:4700:10::6816:3e6b Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mikayla-baldwin.ontraport.com/c/s/VnU/pkBm1/6/48X/Wue2/6MEeiq/602zIqlaRe/P/P/LD
Effective URL:
https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Submission: On March 25 via manual (March 25th 2021, 1:55:10 am UTC) from DE

Summary HTTP 110 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 27 IPs in 3 countries across 23 domains to perform 110 HTTP transactions. The main IP is 2606:4700:10::6816:3e6b, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.financialhealth.net.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 2nd 2020. Valid for: a year.

This is the only time www.financialhealth.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	209.170.211.179 209.170.211.179	13649 (ASN-VINS) (ASN-VINS)
1 1	107.23.243.197 107.23.243.197	14618 (AMAZON-AES) (AMAZON-AES)
1 1	13.32.21.113 13.32.21.113	16509 (AMAZON-02) (AMAZON-02)
19	2606:4700:10:... 2606:4700:10::6816:3e6b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
18	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
1	151.139.242.29 151.139.242.29	33438 (HIGHWINDS2) (HIGHWINDS2)
1	2606:4700:10:... 2606:4700:10::6816:27b6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	104.154.142.214 104.154.142.214	15169 (GOOGLE) (GOOGLE)
6	52.5.64.242 52.5.64.242	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c0c::9a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	13.226.156.196 13.226.156.196	16509 (AMAZON-02) (AMAZON-02)
1	35.173.69.178 35.173.69.178	14618 (AMAZON-AES) (AMAZON-AES)
23	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
3 3	2a00:1450:400... 2a00:1450:4001:811::2004	15169 (GOOGLE) (GOOGLE)
1 1	217.79.188.21 217.79.188.21	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1	217.79.188.59 217.79.188.59	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
110	27

1 209.170.211.179 (Los Angeles, United States) 1 redirects

ASN13649 (ASN-VINS, US)
PTR: mail9.ontramail.com

mikayla-baldwin.ontraport.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.23.243.197 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-23-243-197.compute-1.amazonaws.com

17m99yl.elnk1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.21.113 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-32-21-113.fra56.r.cloudfront.net

api.earnware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2606:4700:10::6816:3e6b (United States)

ASN13335 (CLOUDFLARENET, US)

www.financialhealth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.242.29 (United States)

ASN33438 (HIGHWINDS2, US)

cdn2.lockerdomecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:27b6 (United States)

ASN13335 (CLOUDFLARENET, US)

create.lidstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.154.142.214 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 214.142.154.104.bc.googleusercontent.com

lockerdome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.5.64.242 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-5-64-242.compute-1.amazonaws.com

create.leadid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0c::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.156.196 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-156-196.dus51.r.cloudfront.net

d2m2wsoho8qq12.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.173.69.178 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-69-178.compute-1.amazonaws.com

deviceid.trueleadid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:811::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 217.79.188.21 (Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: ad2.adfarm1.adition.com

ad2.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 217.79.188.59 (Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: imagesrv.adition.com

imagesrv.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
34	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	527 KB
19	financialhealth.net www.financialhealth.net	403 KB
18	doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net	106 KB
6	gstatic.com www.gstatic.com fonts.gstatic.com	84 KB
6	google.com 3 redirects adservice.google.com www.google.com	507 B
6	leadid.com create.leadid.com	2 KB
5	googletagservices.com www.googletagservices.com	171 KB
3	google.de adservice.google.de www.google.de	418 B
2	adition.com 1 redirects ad2.adfarm1.adition.com imagesrv.adition.com	1 KB
2	googleapis.com fonts.googleapis.com	1 KB
2	facebook.com www.facebook.com	343 B
2	google-analytics.com www.google-analytics.com	19 KB
2	facebook.net connect.facebook.net	92 KB
1	trueleadid.com deviceid.trueleadid.com	2 KB
1	cloudfront.net d2m2wsoho8qq12.cloudfront.net	2 KB
1	googleadservices.com partner.googleadservices.com	264 B
1	lockerdome.com lockerdome.com	2 KB
1	lidstatic.com create.lidstatic.com	39 KB
1	lockerdomecdn.com cdn2.lockerdomecdn.com	3 KB
1	googletagmanager.com www.googletagmanager.com	35 KB
1	earnware.com 1 redirects api.earnware.com	425 B
1	elnk1.com 1 redirects 17m99yl.elnk1.com	497 B
1	ontraport.com 1 redirects mikayla-baldwin.ontraport.com	1 KB
110	23

	Domain	Requested by
23	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
19	www.financialhealth.net	www.financialhealth.net
16	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
11	pagead2.googlesyndication.com	www.financialhealth.net pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
6	create.leadid.com	create.lidstatic.com deviceid.trueleadid.com
5	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
4	fonts.gstatic.com	fonts.googleapis.com
4	www.google.com	3 redirects www.financialhealth.net
2	www.gstatic.com	googleads.g.doubleclick.net
2	fonts.googleapis.com	googleads.g.doubleclick.net
2	www.facebook.com	www.financialhealth.net connect.facebook.net
2	stats.g.doubleclick.net	www.google-analytics.com lockerdome.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	connect.facebook.net	www.financialhealth.net connect.facebook.net
1	imagesrv.adition.com	googleads.g.doubleclick.net
1	ad2.adfarm1.adition.com	1 redirects
1	deviceid.trueleadid.com	d2m2wsoho8qq12.cloudfront.net
1	d2m2wsoho8qq12.cloudfront.net	create.lidstatic.com
1	www.google.de	www.financialhealth.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	lockerdome.com	cdn2.lockerdomecdn.com
1	create.lidstatic.com	www.financialhealth.net
1	cdn2.lockerdomecdn.com	www.financialhealth.net
1	www.googletagmanager.com	www.financialhealth.net
1	api.earnware.com	1 redirects
1	17m99yl.elnk1.com	1 redirects
1	mikayla-baldwin.ontraport.com	1 redirects
110	29

This site contains links to these domains. Also see Links.

Domain
www.facebook.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-02` - `2021-08-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
cdn2.lockerdomecdn.com Go Daddy Secure Certificate Authority - G2	`2019-03-06` - `2021-05-05`	2 years	crt.sh
lidstatic.com Cloudflare Inc ECC CA-3	`2020-05-31` - `2021-05-31`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-02-10` - `2021-05-10`	3 months	crt.sh
*.lockerdome.com Go Daddy Secure Certificate Authority - G2	`2020-09-27` - `2021-10-29`	a year	crt.sh
create.leadid.com Amazon	`2020-05-22` - `2021-06-22`	a year	crt.sh
*.googleadservices.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.google.de GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2021-02-22` - `2022-02-21`	a year	crt.sh
deviceid.trueleadid.com Amazon	`2021-02-06` - `2022-03-07`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.adition.com AlphaSSL CA - SHA256 - G2	`2019-05-02` - `2021-05-02`	2 years	crt.sh

This page contains 18 frames:

Primary Page: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Frame ID: 1627E8C65EAB8AEC57A65D2D7D8C4467
Requests: 48 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210322/r20190131/zrt_lookup.html
Frame ID: F43764BD3524136D8E34373816760F28
Requests: 1 HTTP requests in this frame

Frame: https://lockerdome.com/lad/13410072067809894?pubid=ld-5168-6674&pubo=https%3A%2F%2Fwww.financialhealth.net&rid=&width=1068
Frame ID: 7A12DA4DE178BA3A2FB28F42E9D9B325
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&adk=1812271804&adf=3025194257&lmt=1616637292&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&ea=0&flash=0&pra=5&wgl=1&dt=1616637292633&bpp=13&bdt=388&idt=122&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8662885653938&frm=20&pv=2&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&dtd=141
Frame ID: F3DF5D0CD02ED8665746FD46EC72CD96
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2807109705&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292647&bpp=3&bdt=402&idt=137&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=6Ag3KDFGds&p=https%3A//www.financialhealth.net&dtd=144
Frame ID: 6CB13DCFF6BCB4259DCA7B45FD2E3F26
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149
Frame ID: 5A65041011040566F8977773FADB436C
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155
Frame ID: 961BD3646EB9B344D3C6EE0873491B0F
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4578670007&adk=2138847987&adf=1543753041&pi=t.ma~as.4578670007&w=300&lmt=1616637292&psa=0&format=300x250&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292652&bpp=1&bdt=407&idt=156&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1022&ady=141&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=5&uci=a!5&fsb=1&xpc=RMML052IUI&p=https%3A//www.financialhealth.net&dtd=160
Frame ID: 754E9C50F9B7D502BAFE28E968068660
Requests: 13 HTTP requests in this frame

Frame: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=156F82D9-7AEC-351C-3F90-0A82D05D2F71&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.7.0&lck=B881B1B2-DF71-39C9-45E8-E4CC7A9E35D3&lac=EE9325A8-6663-59BB-1FFC-87C1636E50BC
Frame ID: EA8E4D2FE8308CA74EE55992953D6D93
Requests: 1 HTTP requests in this frame

Frame: https://deviceid.trueleadid.com/iframe.html?token=156F82D9-7AEC-351C-3F90-0A82D05D2F71&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.7.0&lck=B881B1B2-DF71-39C9-45E8-E4CC7A9E35D3&lac=EE9325A8-6663-59BB-1FFC-87C1636E50BC
Frame ID: CFB5F886108EA216CD376020E73776F4
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 5F49FEF26DD6ACF9C53DB849DC8C9E48
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: A7DFFCEECE1D3A111E9E26274EBF4CC5
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: FFE6CA23686D64023919D78B6477A6DE
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js
Frame ID: 990E48827B455545D4DF94F92A9DE44A
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js
Frame ID: 29824A792C8E0E466A835337E38BE73D
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js
Frame ID: D19D7F4BB49BCB3963028E8F1C39B0CA
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js
Frame ID: 58F884EEA039DAEEB91266593C6DF1C2
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: C384D57E9FAD23AC5F4F647695DEB686
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://mikayla-baldwin.ontraport.com/c/s/VnU/pkBm1/6/48X/Wue2/6MEeiq/602zIqlaRe/P/P/LD HTTP 302
https://17m99yl.elnk1.com/?placement=fhn&source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&first_name... HTTP 303
https://api.earnware.com/production/contacts?userId=309acf4bd38c32a4c10540e781d8dc44&contentType=appl... HTTP 302
https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-s... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

110
Requests

100 %
HTTPS

65 %
IPv6

23
Domains

29
Subdomains

27
IPs

3
Countries

1488 kB
Transfer

4088 kB
Size

12
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/financialhealth.net/?sub5=156F82D9-7AEC-351C-3F90-0A82D05D2F71
Title: Follow Us on Facebook

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mikayla-baldwin.ontraport.com/c/s/VnU/pkBm1/6/48X/Wue2/6MEeiq/602zIqlaRe/P/P/LD HTTP 302
https://17m99yl.elnk1.com/?placement=fhn&source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&first_name=GREG&email=gregory.fisher%40vodafone.com&content=o HTTP 303
https://api.earnware.com/production/contacts?userId=309acf4bd38c32a4c10540e781d8dc44&contentType=application%2Fx-www-form-urlencoded&successUrl=https%253A%252F%252Fwww.financialhealth.net%252Fround-two-of-ppp-loans%252F%253Futm_placement%253D%255Bplacement%255D%2526utm_source%253D%255Bsource%255D&errorUrl=https%253A%252F%252Fwww.financialhealth.net%252Fround-two-of-ppp-loans%252F%253Futm_placement%253D%255Bplacement%255D%2526utm_source%253D%255Bsource%255D&content=o&email=gregory.fisher%2540vodafone.com&first_name=GREG&placement=fhn&source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD- HTTP 302
https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD- Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 84

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 95

https://ad2.adfarm1.adition.com/banner?sid=4593833&gdpr=&gdpr_consent=&kid=4247907&bid=13263779&wpt=C&ts=256887436&ipt=0 HTTP 302
https://imagesrv.adition.com/1x1.gif

Request Chain 97

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 99

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

110 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.financialhealth.net/round-two-of-ppp-loans/
Redirect Chain

https://mikayla-baldwin.ontraport.com/c/s/VnU/pkBm1/6/48X/Wue2/6MEeiq/602zIqlaRe/P/P/LD
https://17m99yl.elnk1.com/?placement=fhn&source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&first_name=GREG&email=gregory.fisher%40vodafone.com&content=o
https://api.earnware.com/production/contacts?userId=309acf4bd38c32a4c10540e781d8dc44&contentType=application%2Fx-www-form-urlencoded&successUrl=https%253A%252F%252Fwww.financialhealth.net%252Fround...
https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-

90 KB
15 KB

39ms
14ms

Document
text/html

2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf130af380b632a147b9a20af53c278309a601be5d51445f5a68da9af745f48b

Request headers

:method: GET
:authority: www.financialhealth.net
:scheme: https
:path: /round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=dc03a6305c1112411d4872549ada5dc1e1616637292; expires=Sat, 24-Apr-21 01:54:52 GMT; path=/; domain=.financialhealth.net; HttpOnly; SameSite=Lax; Secure
vary: Accept-Encoding Accept-Encoding,Cookie
link: <https://www.financialhealth.net/wp-json/>; rel="https://api.w.org/", <https://www.financialhealth.net/wp-json/wp/v2/posts/10892>; rel="alternate"; type="application/json", <https://www.financialhealth.net/?p=10892>; rel=shortlink
cf-cache-status: HIT
age: 18259
cf-request-id: 0908b086c500004e8b2498c000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6354838468c24e8b-FRA
content-encoding: br

Redirect headers

content-type: application/json
content-length: 179
location: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
date: Thu, 25 Mar 2021 01:54:52 GMT
x-amzn-requestid: 1038221b-4f6f-473d-bc95-971658b7735a
x-amz-apigw-id: cuII3HQXoAMF-Jw=
x-amzn-trace-id: Root=1-605bed6b-1f4d53424318ae1404927d0b;Sampled=0
x-cache: Miss from cloudfront
via: 1.1 3298c44116035984c2fac24b89183c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: lJuF7GaaxSnvhP52loWB1LMvxkCq82jPjnsWeKkFFt4oJNduWuEm2Q==

GET
H2 200 style.min.css
www.financialhealth.net/wp-includes/css/dist/block-library/ 57 KB
8 KB 27ms
24ms Stylesheet
text/css 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-includes/css/dist/block-library/style.min.css?ver=5.7
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29778a6252b89c79ad8a313692c3f4b8ff5e300c463858732f28da488dd2cc05

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 17 Mar 2021 02:31:27 GMT
server: cloudflare
age: 36047
etag: W/"e358-5bdb247aa2df9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cf-ray: 6354838498df4e8b-FRA
cf-request-id: 0908b086df00004e8be707e000000001

GET
H2 200 main.css
www.financialhealth.net/wp-content/plugins/auth0/assets/css/ 350 B
309 B 13ms
11ms Stylesheet
text/css 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-content/plugins/auth0/assets/css/main.css?ver=5.7
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2fc4a2079a70808f477b6e96837d6f8a539192aae036c9cb732c87554d915650

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 13 Feb 2021 19:41:51 GMT
server: cloudflare
age: 34791
etag: W/"1d4-5bb3cf1bda7f5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cf-polished: origSize=468
cf-ray: 6354838498e04e8b-FRA
cf-request-id: 0908b086dc00004e8bf5aef000000001
cf-bgj: minify

GET
H2 200 style.css
www.financialhealth.net/wp-content/plugins/td-composer/td-multi-purpose/ 67 KB
9 KB 24ms
22ms Stylesheet
text/css 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-content/plugins/td-composer/td-multi-purpose/style.css?ver=c784b8db3e66cd68082f3ff7aa2d70e6
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ce8bffe9993debe0780d6912df0ac9350f43416d4a7f23c5fd86702281328dd

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Dec 2020 18:34:12 GMT
server: cloudflare
age: 34791
etag: W/"10f52-5b6ad3cf82fdf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cf-polished: origSize=69458
cf-ray: 6354838498e14e8b-FRA
cf-request-id: 0908b086dc00004e8b228ab000000001
cf-bgj: minify

GET
H2 200 style.css
www.financialhealth.net/wp-content/themes/Newspaper/ 132 KB
23 KB 26ms
24ms Stylesheet
text/css 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-content/themes/Newspaper/style.css?ver=5.7
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4946909cb0494ae08f1563fc323d2f252e388b05298c0fb01028df322696182b

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 01 Mar 2021 11:21:05 GMT
server: cloudflare
age: 34791
etag: W/"22c5b-5bc77d054bdd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cf-polished: origSize=142427
cf-ray: 6354838498e24e8b-FRA
cf-request-id: 0908b086e200004e8b228ac000000001
cf-bgj: minify

GET
H2 200 td_legacy_main.css
www.financialhealth.net/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/ 198 KB
27 KB 20ms
18ms Stylesheet
text/css 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/td_legacy_main.css?ver=c784b8db3e66cd68082f3ff7aa2d70e6
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ddf1f42a7bec68c72f80f6fecf6c7c3d934fff93d7aa035cff8468614c438d48

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Dec 2020 18:34:12 GMT
server: cloudflare
age: 34791
etag: W/"3cfe4-5b6ad3cf9d5bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cf-polished: origSize=249828
cf-ray: 6354838498e34e8b-FRA
cf-request-id: 0908b086dc00004e8bc12fd000000001
cf-bgj: minify

GET
H2 200 td_standard_pack_main.css
www.financialhealth.net/wp-content/plugins/td-standard-pack/Newspaper/assets/css/ 494 KB
37 KB 24ms
23ms Stylesheet
text/css 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-content/plugins/td-standard-pack/Newspaper/assets/css/td_standard_pack_main.css?ver=6b62588d33477b8e3dc5b8b3c9c8d86c
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f0722a81c1b03ebc18826f4f29bca688a1aee89619de0be687dde8c8fab0800

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Dec 2020 18:34:28 GMT
server: cloudflare
age: 34791
etag: W/"9b323-5b6ad3df7ae11"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cf-polished: origSize=635683
cf-ray: 6354838498e44e8b-FRA
cf-request-id: 0908b086dc00004e8ba5843000000001
cf-bgj: minify

GET
H2 200 earnware-lib.js Show response
www.financialhealth.net/wp-content/plugins/earnware-connect/public/js/ 3 KB
1 KB 12ms
11ms Script
application/javascript 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-content/plugins/earnware-connect/public/js/earnware-lib.js?ver=1.0.62
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2168d2df51aaecddcc02caf4764bb76866ed07e0967f18dda16f5bf7ee058b10

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 11 Nov 2020 13:10:26 GMT
server: cloudflare
age: 34791
etag: W/"1017-5b3d484d2cd51"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cf-polished: origSize=4119
cf-ray: 6354838498e54e8b-FRA
cf-request-id: 0908b086dc00004e8bd20c3000000001
cf-bgj: minify

GET
H2 200 jquery.min.js Show response
www.financialhealth.net/wp-includes/js/jquery/ 87 KB
30 KB 18ms
16ms Script
application/javascript 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-includes/js/jquery/jquery.min.js?ver=3.5.1
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Dec 2020 18:28:51 GMT
server: cloudflare
age: 34791
etag: W/"15d98-5b6ad29df754c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 6354838498e64e8b-FRA
cf-request-id: 0908b086dd00004e8bd69f3000000001

GET
H2 200 jquery-migrate.min.js Show response
www.financialhealth.net/wp-includes/js/jquery/ 11 KB
4 KB 17ms
15ms Script
application/javascript 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Dec 2020 18:28:51 GMT
server: cloudflare
age: 34791
etag: W/"2bd8-5b6ad29df272c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 6354838498e74e8b-FRA
cf-request-id: 0908b086dd00004e8ba29ca000000001

GET
H2 200 earnware-tracking.js Show response
www.financialhealth.net/wp-content/plugins/earnware-connect/public/js/ 953 B
376 B 13ms
12ms Script
application/javascript 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-content/plugins/earnware-connect/public/js/earnware-tracking.js?ver=1.0.62
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9c9851fcbe69253eb4cfb15de9e08123f61d75ea590cdb4a297fd2074716e41

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 11 Nov 2020 13:10:26 GMT
server: cloudflare
age: 34791
etag: W/"40a-5b3d484d2cd51"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cf-polished: origSize=1034
cf-ray: 6354838498e84e8b-FRA
cf-request-id: 0908b086dd00004e8bff16f000000001
cf-bgj: minify

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 138 KB
49 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9acc39648034c271183fcc522663eaacd49fc368734d99da2f6305ed615b3e5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49676
x-xss-protection: 0
server: cafe
etag: 13546206454834339654
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 25 Mar 2021 01:54:52 GMT

GET
H2 200 Financial-Health-Logo-2020.png
www.financialhealth.net/wp-content/uploads/sites/47/2020/08/ 6 KB
6 KB 13ms
11ms Image
image/png 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.financialhealth.net/wp-content/uploads/sites/47/2020/08/Financial-Health-Logo-2020.png
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b10d18b41d70ac787cf65aedeacace35641b4fa8ff8bc2b21371799dbbe124b4

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Aug 2020 05:51:38 GMT
server: cloudflare
age: 34801
etag: "1804-5ad5cd493d312"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
accept-ranges: bytes
cf-ray: 6354838509404e8b-FRA
content-length: 6148
cf-request-id: 0908b0872800004e8bd69f5000000001

GET
H2 200 imgonline-com-ua-compressed-GLmneMHByLOnclP-696x465.jpg
www.financialhealth.net/wp-content/uploads/sites/47/2020/11/ 57 KB
57 KB 16ms
15ms Image
image/jpeg 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.financialhealth.net/wp-content/uploads/sites/47/2020/11/imgonline-com-ua-compressed-GLmneMHByLOnclP-696x465.jpg
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c1a9a763ad88572f9e0d64eee198386f3a4b560ceefd12a5e1032328e568bf0

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
cf-cache-status: HIT
last-modified: Wed, 11 Nov 2020 20:25:30 GMT
server: cloudflare
age: 36968
etag: "e345-5b3da98bd9e25"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
accept-ranges: bytes
cf-ray: 6354838509414e8b-FRA
content-length: 58181
cf-request-id: 0908b0872800004e8ba29cc000000001
cf-bgj: h2pri

GET
H2 200 wp-emoji-release.min.js Show response
www.financialhealth.net/wp-includes/js/ 14 KB
4 KB 12ms
11ms Script
application/javascript 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-includes/js/wp-emoji-release.min.js?ver=5.7
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 03 Feb 2021 23:47:35 GMT
server: cloudflare
age: 34801
etag: W/"3795-5ba77361d87a6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 6354838509424e8b-FRA
cf-request-id: 0908b0872800004e8bff171000000001

GET
H2 200 earnware-merge.js Show response
www.financialhealth.net/wp-content/plugins/earnware-connect/public/js/ 391 B
384 B 10ms
10ms Script
application/javascript 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-content/plugins/earnware-connect/public/js/earnware-merge.js?ver=1.0.62
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16739a26b8231da1d897cbe780cbc053c90eaf9491e7699e392aafbfdaf49c2f

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 11 Nov 2020 13:10:26 GMT
server: cloudflare
age: 34801
etag: W/"50c-5b3d484d2cd51"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cf-polished: origSize=1292
cf-ray: 63548384c9154e8b-FRA
cf-request-id: 0908b0870200004e8ba29cb000000001
cf-bgj: minify

GET
H2 200 tagdiv_theme.min.js Show response
www.financialhealth.net/wp-content/plugins/td-composer/legacy/Newspaper/js/ 253 KB
55 KB 27ms
26ms Script
application/javascript 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-content/plugins/td-composer/legacy/Newspaper/js/tagdiv_theme.min.js?ver=10.3.9.1
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7246ea8f0ede1f2eadd6aa077545b7e0423f39e19d33c7c9a99d400afbe1bbb

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Dec 2020 18:34:12 GMT
server: cloudflare
age: 34801
etag: W/"3f512-5b6ad3cf9c61f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 63548384e9224e8b-FRA
cf-request-id: 0908b0870d00004e8bee0a5000000001

GET
H2 200 comment-reply.min.js Show response
www.financialhealth.net/wp-includes/js/ 3 KB
1 KB 12ms
9ms Script
application/javascript 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-includes/js/comment-reply.min.js?ver=5.7
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab21fef3ac4ee12ebb305942f85de99b290b8a24654c69060e54673d5f3a11f2

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 03 Feb 2021 23:47:35 GMT
server: cloudflare
age: 34801
etag: W/"ba6-5ba77361d87a6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 63548385093d4e8b-FRA
cf-request-id: 0908b0872800004e8bc12ff000000001

GET
H2 200 wp-embed.min.js Show response
www.financialhealth.net/wp-includes/js/ 1 KB
779 B 12ms
10ms Script
application/javascript 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-includes/js/wp-embed.min.js?ver=5.7
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Referer: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 03 Feb 2021 23:47:35 GMT
server: cloudflare
age: 34801
etag: W/"592-5ba77361d6866"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 63548385093e4e8b-FRA
cf-request-id: 0908b0872800004e8ba5845000000001

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 90 KB
35 KB 22ms
20ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WT894TD

Requested by

Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9596c5ef43d18217545384f2acbae62e6bdfc2682494adbb3f129efb0f0282ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35472
x-xss-protection: 0
last-modified: Thu, 25 Mar 2021 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 25 Mar 2021 01:54:52 GMT

GET
H2 200 newspaper.woff
www.financialhealth.net/wp-content/themes/Newspaper/images/icons/ 123 KB
123 KB 13ms
12ms Font
font/woff 2606:4700:10::6816:3e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.financialhealth.net/wp-content/themes/Newspaper/images/icons/newspaper.woff?19
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/wp-content/themes/Newspaper/style.css?ver=5.7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 557c7d8dd32557129cec3d5d4f221eef6e8706e0855f826f5f6db4278e08420b

Request headers

Origin: https://www.financialhealth.net
Referer: https://www.financialhealth.net/wp-content/themes/Newspaper/style.css?ver=5.7
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
cf-cache-status: HIT
last-modified: Thu, 17 Dec 2020 18:33:38 GMT
server: cloudflare
age: 36047
etag: "1eab4-5b6ad3af4229a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
accept-ranges: bytes
cf-ray: 6354838529504e8b-FRA
content-length: 125620
cf-request-id: 0908b0873400004e8bb0081000000001

GET
DATA 200
OK truncated
/ 111 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7ae5b52b01b37efb4547c3493f75abf51dc034326bb6f1ff6fc97348065716ba

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ajs.js Show response
cdn2.lockerdomecdn.com/_js/ 5 KB
3 KB 68ms
20ms Script
application/javascript 151.139.242.29
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.lockerdomecdn.com/_js/ajs.js
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.29 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 17c017479dd90e883c66518bc09e8e77eb17fd4186fc172b5565e2014ad8e2e9

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: gzip
last-modified: Wed, 24 Mar 2021 18:14:37 GMT
server: nginx
etag: W/"14f4-178657210ae"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: https://lockerdome.com

GET
H2 200 b881b1b2-df71-39c9-45e8-e4cc7a9e35d3.js Show response
create.lidstatic.com/campaign/ 123 KB
39 KB 59ms
37ms Script
text/javascript 2606:4700:10::6816:27b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://create.lidstatic.com/campaign/b881b1b2-df71-39c9-45e8-e4cc7a9e35d3.js?snippet_version=2
Requested by: Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:27b6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd8b6069109cb27dee7a87bade1aa6190fd0b88df2971a117d92eb28a692f6bf

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 596
x-amz-replication-status: COMPLETED
x-amz-request-id: 3GVQG8E8MTXH57JH
x-amz-id-2: vSSp1dX5cUos2J/jEbXSfIs/LPxtsvw9eo8OFAH5b+xoMuYQlIYNno+Be5I3NGoJB21yxnKh7SE=
last-modified: Fri, 06 Nov 2020 14:47:55 GMT
server: cloudflare
etag: W/"b7e113953dbff3353bdb58354a9106cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=1800
x-amz-version-id: PRyO6jnwucddW9jHhn3Khp64WI7qd5Bw
cf-request-id: 0908b088620000dff3782c8000000001
cf-ray: 6354838709c5dff3-FRA

GET
H3-Q050 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210322/r20190131/ 226 KB
85 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210322/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1109401964623664&plah=www.financialhealth.net&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8e845b3c43da250d2131dcca1a9af77bdaca1b61f1215be6317f2d5f17f999e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 86619
x-xss-protection: 0
server: cafe
etag: 10759459106970592627
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 25 Mar 2021 01:54:52 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210322/r20190131/ Frame F437 10 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210322/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c44ef8885a1386dad99986e4de63457883d50b1a966d27b502f37d691d7bd770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210322/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.financialhealth.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.financialhealth.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 24 Mar 2021 02:30:17 GMT
expires: Wed, 07 Apr 2021 02:30:17 GMT
content-type: text/html; charset=UTF-8
etag: 14488317231655078900
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4661
x-xss-protection: 0
age: 84275
cache-control: public, max-age=1209600
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 91 KB
23 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23762
x-fb-rlafr: 0
pragma: public
x-fb-debug: rLsChzVoiXhxr1/MD4EudgE61DX0nOWaheXMg3kdhQ4JSwdiL9AjcQ8UWwayTvHRpqmMCKQt1wlOHP49ZMpt6A==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Thu, 25 Mar 2021 01:54:52 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WT894TD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Feb 2021 21:33:27 GMT
server: Golfe2
age: 1587
date: Thu, 25 Mar 2021 01:28:25 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18980
expires: Thu, 25 Mar 2021 03:28:25 GMT

GET
H/1.1 200
OK 13410072067809894 Show response
lockerdome.com/lad/ Frame 7A12 1 KB
2 KB 556ms
196ms Document
text/html 104.154.142.214
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lockerdome.com/lad/13410072067809894?pubid=ld-5168-6674&pubo=https%3A%2F%2Fwww.financialhealth.net&rid=&width=1068
Requested by: Host: cdn2.lockerdomecdn.com
URL: https://cdn2.lockerdomecdn.com/_js/ajs.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.154.142.214 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 214.142.154.104.bc.googleusercontent.com
Software: /
Resource Hash: ba2d293f01789ef093b5b67ca430d9d1a95a5782e7f72e9b961163f4ba56f43b

Request headers

Host: lockerdome.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.financialhealth.net/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.financialhealth.net/

Response headers

P3P: CP='LockerDome does not have a P3P policy. Learn why here: http://lockerdome.com/p3p'
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Content-Type: text/html; charset=utf-8
Content-Length: 1376
Date: Thu, 25 Mar 2021 01:54:53 GMT

GET
H2 200 2428119880771888 Show response
connect.facebook.net/signals/config/ 240 KB
69 KB 7ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2428119880771888?v=2.9.33&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fdc604cdec66000a6ead0908e5aa504ed4a56aa21067c2d44eaf26bad3685a40

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 70489
x-fb-rlafr: 0
pragma: public
x-fb-debug: +Nmaxclro/tdgy1423NyDtPhqfuRkdyqISJhXoaYDHbl5rlxeI0VWYYXX4bChXSEAt76TNW03T8KYOfz0aj3kA==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Thu, 25 Mar 2021 01:54:52 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 GenerateToken Show response
create.leadid.com/2.7.0/ 36 B
332 B 344ms
140ms XHR
text/plain 52.5.64.242
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://create.leadid.com/2.7.0/GenerateToken?msn=1&pid=a4ef427a-36d2-46df-84fd-5247791258a5&_=744771314
Requested by: Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/b881b1b2-df71-39c9-45e8-e4cc7a9e35d3.js?snippet_version=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.64.242 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-64-242.compute-1.amazonaws.com
Software: nginx/1.17.6 / PHP/7.1.33
Resource Hash: 95ac961a016051c48bc7e031957bf5c1b0cc2f50551725653efeebc56577fb76

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 25 Mar 2021 01:54:53 GMT
content-encoding: gzip
server: nginx/1.17.6
x-powered-by: PHP/7.1.33
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
72 B 13ms
13ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&a=1600341097&t=pageview&_s=1&dl=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&ul=en-us&de=UTF-8&dt=Round%20Two%20of%20PPP%20Loans%20%7C%20Financial%20Health%20Network&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAAABAAAAAC~&jid=2072189628&gjid=1541331966&cid=431683304.1616637293&tid=UA-101848309-1&_gid=1915735882.1616637293&_r=1&gtm=2wg3h0WT894TD&z=665779450

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 25 Mar 2021 01:54:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.financialhealth.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 209 B
264 B 31ms
30ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.financialhealth.net&callback=_gfp_s_&client=ca-pub-1109401964623664

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210322/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1109401964623664&plah=www.financialhealth.net&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

ffb443fb8f9f8551a45baac0c990456a32e3a671b36bd65f07d0a4a75b77c9c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 195
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.financialhealth.net

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.financialhealth.net

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F3DF 54 B
207 B 47ms
47ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&adk=1812271804&adf=3025194257&lmt=1616637292&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&ea=0&flash=0&pra=5&wgl=1&dt=1616637292633&bpp=13&bdt=388&idt=122&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8662885653938&frm=20&pv=2&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&dtd=141

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

166a4ec3cb90d525f7f744c7616c01b36bebd6dcecd486c8f5be14ccc0a7b3da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1109401964623664&output=html&adk=1812271804&adf=3025194257&lmt=1616637292&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&ea=0&flash=0&pra=5&wgl=1&dt=1616637292633&bpp=13&bdt=388&idt=122&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8662885653938&frm=20&pv=2&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&dtd=141
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.financialhealth.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.financialhealth.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 25 Mar 2021 01:54:52 GMT
server: cafe
content-length: 34
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 25-Mar-2021 02:09:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 25 Mar 2021 01:54:52 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cac02e231c61068da6a4e6c177f2ccd14a5360aa3509af3be992bfbbad0c127b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616585787019197"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28245
x-xss-protection: 0
expires: Thu, 25 Mar 2021 01:54:52 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
94 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c0c::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-101848309-1&cid=431683304.1616637293&jid=2072189628&gjid=1541331966&_gid=1915735882.1616637293&_u=YEBAAAAAAAAAAC~&z=797503775

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 25 Mar 2021 01:54:52 GMT
content-type: text/plain
access-control-allow-origin: https://www.financialhealth.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6CB1 53 KB
20 KB 423ms
422ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2807109705&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292647&bpp=3&bdt=402&idt=137&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=6Ag3KDFGds&p=https%3A//www.financialhealth.net&dtd=144

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

779b4e1918fa1b99b1ecd1fee9ce12a0419b5fed3084e20d161b1d62ba92f4a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2807109705&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292647&bpp=3&bdt=402&idt=137&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=6Ag3KDFGds&p=https%3A//www.financialhealth.net&dtd=144
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.financialhealth.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.financialhealth.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 25 Mar 2021 01:54:53 GMT
server: cafe
content-length: 20432
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 25-Mar-2021 02:09:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 25 Mar 2021 01:54:53 GMT
cache-control: private

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5A65 48 KB
19 KB 440ms
440ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21179a2f74ea52ff3053b565400fad76c1b18f4b85b37d8fc0b786e05cd48d46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.financialhealth.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.financialhealth.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 25 Mar 2021 01:54:53 GMT
server: cafe
content-length: 18914
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 25-Mar-2021 02:09:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 25 Mar 2021 01:54:53 GMT
cache-control: private

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 17ms
16ms Image
image/gif 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-101848309-1&cid=431683304.1616637293&jid=2072189628&_u=YEBAAAAAAAAAAC~&z=853264781

Requested by

Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 25 Mar 2021 01:54:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 17ms
16ms Image
image/gif 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-101848309-1&cid=431683304.1616637293&jid=2072189628&_u=YEBAAAAAAAAAAC~&z=853264781

Requested by

Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 25 Mar 2021 01:54:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 961B 67 KB
22 KB 633ms
633ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3563bbdfe6b6dd91291e206740f7ce1398285b98a5972394847541cb4d89f29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.financialhealth.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.financialhealth.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 25 Mar 2021 01:54:53 GMT
server: cafe
content-length: 22400
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 25-Mar-2021 02:09:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 25 Mar 2021 01:54:53 GMT
cache-control: private

GET
H3-Q050 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
146 B 15ms
14ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.financialhealth.net

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
146 B 15ms
15ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.financialhealth.net

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 25 Mar 2021 01:54:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 754E 69 KB
22 KB 429ms
429ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4578670007&adk=2138847987&adf=1543753041&pi=t.ma~as.4578670007&w=300&lmt=1616637292&psa=0&format=300x250&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292652&bpp=1&bdt=407&idt=156&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1022&ady=141&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=5&uci=a!5&fsb=1&xpc=RMML052IUI&p=https%3A//www.financialhealth.net&dtd=160

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3981b09097f908c9ff786d4dc1ff753a846c25e9cbde3456ab17f713176b9118

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4578670007&adk=2138847987&adf=1543753041&pi=t.ma~as.4578670007&w=300&lmt=1616637292&psa=0&format=300x250&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292652&bpp=1&bdt=407&idt=156&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1022&ady=141&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=5&uci=a!5&fsb=1&xpc=RMML052IUI&p=https%3A//www.financialhealth.net&dtd=160
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.financialhealth.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.financialhealth.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 25 Mar 2021 01:54:53 GMT
server: cafe
content-length: 22845
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 25-Mar-2021 02:09:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 25 Mar 2021 01:54:53 GMT
cache-control: private

GET
H2 200 /
www.facebook.com/tr/ 44 B
263 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2428119880771888&ev=PageView&dl=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&rl=&if=false&ts=1616637292877&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=30&fbp=fb.1.1616637292875.983000561&it=1616637292724&coo=false&rqm=GET

Requested by

Host: www.financialhealth.net
URL: https://www.financialhealth.net/round-two-of-ppp-loans/?utm_placement=fhn&utm_source=finance-MB-f-on-hr-01-sui-03242021-8-AK-BD-

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:52 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Thu, 25 Mar 2021 01:54:52 GMT

GET
H/1.1 200
OK iframe.html Show response
d2m2wsoho8qq12.cloudfront.net/ Frame EA8E 3 KB
2 KB 93ms
25ms Document
text/html 13.226.156.196
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=156F82D9-7AEC-351C-3F90-0A82D05D2F71&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.7.0&lck=B881B1B2-DF71-39C9-45E8-E4CC7A9E35D3&lac=EE9325A8-6663-59BB-1FFC-87C1636E50BC
Requested by: Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/b881b1b2-df71-39c9-45e8-e4cc7a9e35d3.js?snippet_version=2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.156.196 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-156-196.dus51.r.cloudfront.net
Software: nginx/1.17.6 /
Resource Hash: 4e2d95df10e65f48daac2dcbad2cc0ef091610b5d5f77e4be8ad56a2e5aed241

Request headers

Host: d2m2wsoho8qq12.cloudfront.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.financialhealth.net/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.financialhealth.net/

Response headers

Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Date: Wed, 24 Mar 2021 05:53:40 GMT
Server: nginx/1.17.6
Last-Modified: Mon, 22 Mar 2021 13:26:42 GMT
ETag: W/"60589b12-da5"
P3P: CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
Content-Encoding: gzip
X-Cache: Hit from cloudfront
Via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DUS51-C1
X-Amz-Cf-Id: eCZh6QPr99owI2WGS2ppkhWAC61Pmt6NPoICL94icrPK-fgncZeQng==
Age: 72073

POST
H2 200 SaveDom Show response
create.leadid.com/2.7.0/ 0
298 B 106ms
106ms XHR
text/plain 52.5.64.242
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://create.leadid.com/2.7.0/SaveDom?msn=2&pid=a4ef427a-36d2-46df-84fd-5247791258a5&token=156F82D9-7AEC-351C-3F90-0A82D05D2F71&_=744771315
Requested by: Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/b881b1b2-df71-39c9-45e8-e4cc7a9e35d3.js?snippet_version=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.64.242 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-64-242.compute-1.amazonaws.com
Software: nginx/1.17.6 / PHP/7.1.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 25 Mar 2021 01:54:53 GMT
content-encoding: gzip
server: nginx/1.17.6
x-powered-by: PHP/7.1.33
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 InitFormData Show response
create.leadid.com/2.7.0/ 0
298 B 108ms
108ms XHR
text/plain 52.5.64.242
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://create.leadid.com/2.7.0/InitFormData?msn=3&pid=a4ef427a-36d2-46df-84fd-5247791258a5&token=156F82D9-7AEC-351C-3F90-0A82D05D2F71&_=744771316
Requested by: Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/b881b1b2-df71-39c9-45e8-e4cc7a9e35d3.js?snippet_version=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.64.242 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-64-242.compute-1.amazonaws.com
Software: nginx/1.17.6 / PHP/7.1.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 25 Mar 2021 01:54:53 GMT
content-encoding: gzip
server: nginx/1.17.6
x-powered-by: PHP/7.1.33
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK iframe.html Show response
deviceid.trueleadid.com/ Frame CFB5 4 KB
2 KB 424ms
104ms Document
text/html 35.173.69.178
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://deviceid.trueleadid.com/iframe.html?token=156F82D9-7AEC-351C-3F90-0A82D05D2F71&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.7.0&lck=B881B1B2-DF71-39C9-45E8-E4CC7A9E35D3&lac=EE9325A8-6663-59BB-1FFC-87C1636E50BC
Requested by: Host: d2m2wsoho8qq12.cloudfront.net
URL: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=156F82D9-7AEC-351C-3F90-0A82D05D2F71&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.7.0&lck=B881B1B2-DF71-39C9-45E8-E4CC7A9E35D3&lac=EE9325A8-6663-59BB-1FFC-87C1636E50BC
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.69.178 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-69-178.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3dd1fa07e4802c23e53915d6e8a450445a9c50efcada797976b64eff77fbb6bd

Request headers

Host: deviceid.trueleadid.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://d2m2wsoho8qq12.cloudfront.net/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d2m2wsoho8qq12.cloudfront.net/

Response headers

Cache-Control: max-age=86400 public
Content-Encoding: gzip
Content-Type: text/html
Date: Thu, 25 Mar 2021 01:54:53 GMT
ETag: W/"5edf9bec-104a"
Expires: Fri, 26 Mar 2021 01:54:53 GMT
Last-Modified: Tue, 09 Jun 2020 14:25:48 GMT
P3P: CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
Server: nginx
Content-Length: 1736
Connection: keep-alive

GET
H2 200 3477809464320021156
tpc.googlesyndication.com/simgad/ Frame 6CB1 35 KB
35 KB 7ms
6ms Image
image/png 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3477809464320021156?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkCT-FK8uKtfnpqQgoPVR9JfpgzGQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2807109705&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292647&bpp=3&bdt=402&idt=137&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=6Ag3KDFGds&p=https%3A//www.financialhealth.net&dtd=144

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43afa903212857894391cd1020a11e1519b50097812701aa270fb975f4699bcd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 21 Mar 2021 11:59:23 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 14:11:44 GMT
server: sffe
age: 309330
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35691
x-xss-protection: 0
expires: Mon, 21 Mar 2022 11:59:23 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/ Frame 6CB1 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab2acc5edb2198c0c0c25a5a4a470df2a048c69e982d11b4b96f22b21332fe2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 00:51:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7120
x-xss-protection: 0
server: cafe
etag: 14491782869175424788
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 00:51:16 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 6CB1 2 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:33:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1306
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 01:33:07 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6CB1 118 KB
36 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e705dfac9d3d11ae87071979b2bbb52db73d03fff6252c1b73ce5b3c7ebb6e9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616585768493349"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36563
x-xss-protection: 0
expires: Thu, 25 Mar 2021 01:54:53 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 6CB1 12 KB
5 KB 8ms
5ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d890a48ea501050f8167a15968c0d8d1d654a54ce3058242ab99acdfb81e288

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2824
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5520
x-xss-protection: 0
server: cafe
etag: 4598867394938533942
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 01:07:49 GMT

GET
H2 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 6CB1 24 KB
10 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7bc5cdc982210fa5f543ec21cb32c7246c3226cc4d48a525248df920af7eb107

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 24 Mar 2021 16:35:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33540
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10339
x-xss-protection: 0
server: cafe
etag: 15412717976415995934
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Apr 2021 16:35:53 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6CB1 0
0 44ms
43ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CWwEvbO1bYPadMcXq3wP2q5foA4qKtMthwfnu-cwMpfqI76AOEAEg84aaAmCVAqABnbDuoQPIAQKpAhgbWsB-0bM-qAMByAPJBKoE_wFP0BwKaQGTvIUzAxQ4AZ_COENpU_Xi0061GPRPsx2FHPLQmLB5PY0fVmbgKO-xRav5T8XmpU9l_CVFFz45JmRoBmwItALMWCPE_dcNfvSsEzxh8pAt4DtqztptzkkVF-peVB7BfnriPw7QwQSClBS_lQD2nyeo3o77q014FMuwxRw_0vuqe2rp0cGfqcXnnLLEfzkyF-o8Qnz5zyf9u1JIySrgowFf18Hf422zJSsABRdG2y5P5HW6E_EoF_VyJl0kxrrdYzao-L3DjSEsvwn_h7dkLKNULsZyxPtlL5ZdIeKK7psjKoshVCtVvkcuv3JIik-_X2VemuIGR6EGD8jABJqZmsPrAZIFBAgEGAGSBQQIBRgEoAYCgAf1tJteqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcFEJCq1hPSCAkIgOGAEBABGB-ACgHICwHYEwyyFxoKGAgAEhRwdWItMTEwOTQwMTk2NDYyMzY2NA&sigh=TX5cent2h38&tpd=AGWhJmu1dWibdzCENYRwcuGy21-EMdRTMMldFH50-PpjgVUf2g

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2807109705&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292647&bpp=3&bdt=402&idt=137&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=6Ag3KDFGds&p=https%3A//www.financialhealth.net&dtd=144
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 25 Mar 2021 01:54:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 25 Mar 2021 01:54:53 GMT

GET
H3-Q050 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5F49 143 B
169 B 6ms
5ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2807109705&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292647&bpp=3&bdt=402&idt=137&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=6Ag3KDFGds&p=https%3A//www.financialhealth.net&dtd=144
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2807109705&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292647&bpp=3&bdt=402&idt=137&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=6Ag3KDFGds&p=https%3A//www.financialhealth.net&dtd=144

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 25 Mar 2021 01:41:26 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 807
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 css
fonts.googleapis.com/ Frame 754E 4 KB
713 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4578670007&adk=2138847987&adf=1543753041&pi=t.ma~as.4578670007&w=300&lmt=1616637292&psa=0&format=300x250&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292652&bpp=1&bdt=407&idt=156&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1022&ady=141&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=5&uci=a!5&fsb=1&xpc=RMML052IUI&p=https%3A//www.financialhealth.net&dtd=160

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d344632c01d1ca55dc380216de660c9b8a5a3174e7d7afa6784aff50c945e1cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 25 Mar 2021 01:26:48 GMT
server: ESF
date: Thu, 25 Mar 2021 01:54:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 25 Mar 2021 01:54:53 GMT

GET
DATA 200
OK truncated
/ Frame 6CB1 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf879f269821507f6a580b554d6a3cb55e2bc575220d46610ae65fe4138e69ee

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 3477809464320021156
tpc.googlesyndication.com/simgad/ Frame 5A65 35 KB
35 KB 7ms
7ms Image
image/png 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3477809464320021156?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkCT-FK8uKtfnpqQgoPVR9JfpgzGQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43afa903212857894391cd1020a11e1519b50097812701aa270fb975f4699bcd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 21 Mar 2021 11:59:23 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 14:11:44 GMT
server: sffe
age: 309330
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35691
x-xss-protection: 0
expires: Mon, 21 Mar 2022 11:59:23 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/ Frame 5A65 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab2acc5edb2198c0c0c25a5a4a470df2a048c69e982d11b4b96f22b21332fe2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 00:51:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7120
x-xss-protection: 0
server: cafe
etag: 14491782869175424788
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 00:51:16 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 5A65 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:33:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1306
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 01:33:07 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5A65 118 KB
36 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e705dfac9d3d11ae87071979b2bbb52db73d03fff6252c1b73ce5b3c7ebb6e9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616585768493349"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36563
x-xss-protection: 0
expires: Thu, 25 Mar 2021 01:54:53 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 5A65 12 KB
5 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d890a48ea501050f8167a15968c0d8d1d654a54ce3058242ab99acdfb81e288

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2824
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5520
x-xss-protection: 0
server: cafe
etag: 4598867394938533942
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 01:07:49 GMT

GET
H3-Q050 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 5A65 24 KB
10 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7bc5cdc982210fa5f543ec21cb32c7246c3226cc4d48a525248df920af7eb107

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 24 Mar 2021 16:35:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33540
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10339
x-xss-protection: 0
server: cafe
etag: 15412717976415995934
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Apr 2021 16:35:53 GMT

GET
H3-Q050 200 bg_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/elements/html/ Frame 5A65 5 KB
3 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/elements/html/bg_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

700e8ea9519fbadffcfb3395c4a3e3dcb7b92ae5eb3387aaedb4fc30ea0cf522

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 24 Mar 2021 02:50:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2608
x-xss-protection: 0
server: cafe
etag: 11930805656079872756
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Apr 2021 02:50:58 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 5A65 0
0 43ms
43ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CeCEWbO1bYO_cMYL33wPripDYC4qKtMthwfnu-cwM1uPT8YwOEAEg84aaAmCVAqABnbDuoQPIAQKpAhgbWsB-0bM-qAMByAPJBKoE_wFP0LjintP2MdlAp8mqt6uBmRo_6eNEGE0BgFTUqn2lCZ1z77-IeIPURrIvwgy7IwzoJUguZ6QwR1eAJQfgm_ZorrB-_IkgkBNHh9mcUlLwdwLD4TVUaNFB4-MCp01F2mFhIEBABlO1ssJJHfPl5sRmSqs7VglziU90Xf0LyYbXGavak6mRjggmRy5s9oJp7PX6064BlI-tYbGqcWR0EZZAFkOcaZdG7n40-AeIiChhvG8ygpOmV8Fb-or-OTtSOFoekeIY-2iYpGCy4YmJzAp_wecTfgxtgSl775YDl7qlvpqm6tgxnORZ_qLImyXJJvUq4pnB3jNTVN5uPRHU5F_ABJqZmsPrAZIFBAgEGAGSBQQIBRgEoAYCgAf1tJteqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcFELmVjAXSCAkIgOGAEBABGB-ACgHICwHYEwyyFxoKGAgAEhRwdWItMTEwOTQwMTk2NDYyMzY2NA&sigh=8Ny1JTKlvps&tpd=AGWhJmvYh3oLCmhDZwzcEFOZzQlYcURXi02T2qTRSnZqdOF-FA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 25 Mar 2021 01:54:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 754E 1 KB
980 B 8ms
7ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:40:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 862
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 01:40:31 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/ Frame 754E 17 KB
7 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab2acc5edb2198c0c0c25a5a4a470df2a048c69e982d11b4b96f22b21332fe2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 00:51:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7120
x-xss-protection: 0
server: cafe
etag: 14491782869175424788
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 00:51:16 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 754E 2 KB
1 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:33:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1306
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 01:33:07 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 754E 118 KB
36 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e705dfac9d3d11ae87071979b2bbb52db73d03fff6252c1b73ce5b3c7ebb6e9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616585768493349"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36563
x-xss-protection: 0
expires: Thu, 25 Mar 2021 01:54:53 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 754E 12 KB
5 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d890a48ea501050f8167a15968c0d8d1d654a54ce3058242ab99acdfb81e288

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2824
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5520
x-xss-protection: 0
server: cafe
etag: 4598867394938533942
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 01:07:49 GMT

GET
H2 200 957c89dfc9e78dd5a0a3956da91f5358.js Show response
www.gstatic.com/mysidia/ Frame 754E 25 KB
11 KB 10ms
5ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/957c89dfc9e78dd5a0a3956da91f5358.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74701d1b03dcb606710d7cc01bbf35a36ad5e5e443e33e55894a013f0d65aacf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 18 Mar 2021 10:35:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 12 Mar 2021 03:13:35 GMT
server: sffe
age: 573593
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10839
x-xss-protection: 0
expires: Wed, 16 Jun 2021 10:35:00 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 754E 0
0 43ms
42ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CKxkRbO1bYLi6MoqNrASkhZKwBrvKg_9h7IPYv8YNv-EeEAEg84aaAmCVAqABydrG0wPIAQGpAhgbWsB-0bM-qAMByAPLBKoE7gFP0IjGm2Bt322pv5sM-TDLGyIRJfFhwdirvBhBnnpfQmVknQrMjqMmv5YXnFDL-f7Csqf-K6Dd0_LMA1Erfsr28e4MCFJQCdc0eEU49Z6MscDYFm41ploGqk5UX6a7UBMxP5dWEOkp7VfEDLTSO47q2gAaasM20uXJlUiS5ACdafxJxTkvgNcxi2pZcY_TPTDmee4SXXSFTXBBHIXbfUH3-BtLCId25cliVhYQ-wRwUvfKZmdytN3qsx0_1L4oqOjfudPVFimd4I6zSSkis44C8eLycH0K5gVfA5NVIT_CT7EH_wrmqDxjHhEhq51EwASslOfY3AOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAYAHhYXaGagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBRDU4YwM0ggJCIDhgBAQARgfgAoByAsB2BMNiBQBmBYBshcaChgIABIUcHViLTExMDk0MDE5NjQ2MjM2NjQ&sigh=-bYcIImRheg&tpd=AGWhJmtwgoF47porer0O8lrBOyzuFCY_8AM5CXX7XDswbP8VWA

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4578670007&adk=2138847987&adf=1543753041&pi=t.ma~as.4578670007&w=300&lmt=1616637292&psa=0&format=300x250&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292652&bpp=1&bdt=407&idt=156&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1022&ady=141&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=5&uci=a!5&fsb=1&xpc=RMML052IUI&p=https%3A//www.financialhealth.net&dtd=160
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 25 Mar 2021 01:54:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A7DF 143 B
165 B 6ms
5ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkx8iuAht0dbs7WQgzP6enarTrJKurw87DVU788BRrrV6G7T37dI8bL0lIrzvY
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 25 Mar 2021 01:41:26 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 807
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FFE6 143 B
165 B 5ms
5ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4578670007&adk=2138847987&adf=1543753041&pi=t.ma~as.4578670007&w=300&lmt=1616637292&psa=0&format=300x250&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292652&bpp=1&bdt=407&idt=156&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1022&ady=141&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=5&uci=a!5&fsb=1&xpc=RMML052IUI&p=https%3A//www.financialhealth.net&dtd=160
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkx8iuAht0dbs7WQgzP6enarTrJKurw87DVU788BRrrV6G7T37dI8bL0lIrzvY
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4578670007&adk=2138847987&adf=1543753041&pi=t.ma~as.4578670007&w=300&lmt=1616637292&psa=0&format=300x250&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292652&bpp=1&bdt=407&idt=156&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1022&ady=141&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=5&uci=a!5&fsb=1&xpc=RMML052IUI&p=https%3A//www.financialhealth.net&dtd=160

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 25 Mar 2021 01:41:26 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 807
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 dc.js Show response
stats.g.doubleclick.net/ Frame 7A12 45 KB
17 KB 29ms
15ms Script
text/javascript 2a00:1450:400c:c0c::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: lockerdome.com
URL: https://lockerdome.com/lad/13410072067809894?pubid=ld-5168-6674&pubo=https%3A%2F%2Fwww.financialhealth.net&rid=&width=1068

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Feb 2021 21:33:27 GMT
server: Golfe2
age: 2936
date: Thu, 25 Mar 2021 01:05:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17093
expires: Thu, 25 Mar 2021 03:05:57 GMT

GET
DATA 200
OK truncated
/ Frame 5A65 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed18c8f2da493ab85969d23f9f8f495c35eb3f29a35f66683ef4b3eb6da6ee43

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 754E 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1bfcd59fe380451c90d3d9d72a8dcd4ef7836c84654b758d7966395065dd1395

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 754E 16 KB
16 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24369e1b2461af9dcefecaf9cc93d64cf22a4c5bac32506100b9e21014507bcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 22 Mar 2021 18:27:39 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:37 GMT
server: sffe
age: 199634
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15872
x-xss-protection: 0
expires: Tue, 22 Mar 2022 18:27:39 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 754E 15 KB
15 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 22 Mar 2021 18:51:47 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:36 GMT
server: sffe
age: 198186
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15736
x-xss-protection: 0
expires: Tue, 22 Mar 2022 18:51:47 GMT

POST
H2 200 /
www.facebook.com/tr/ 0
80 B 6ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryQuYPTUYdj56WXNdC

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Thu, 25 Mar 2021 01:54:53 GMT
content-type: text/plain
access-control-allow-origin: https://www.financialhealth.net
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame 961B 6 KB
737 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e47a27d91c2487289d6607ee10d7cb7b31944a5ed3ff5ffc86ec8526e9374af0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 25 Mar 2021 01:25:39 GMT
server: ESF
date: Thu, 25 Mar 2021 01:54:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 25 Mar 2021 01:54:53 GMT

GET
H3-Q050

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5F49
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
110 B

15ms
14ms

Document
text/html

2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkx8iuAht0dbs7WQgzP6enarTrJKurw87DVU788BRrrV6G7T37dI8bL0lIrzvY; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 25 Mar 2021 01:54:53 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Thu, 25-Mar-2021 02:54:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 25 Mar 2021 01:54:53 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 25 Mar 2021 01:54:53 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js Show response
pagead2.googlesyndication.com/bg/ Frame 990E 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9249fd9f8183f4e5e0ae23c3e24386fdd3c7e79ec3e788cb1f11483ce1a60a95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 23 Mar 2021 17:17:21 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 117452
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5656
x-xss-protection: 0
expires: Wed, 23 Mar 2022 17:17:21 GMT

GET
H3-Q050 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 961B 1 KB
910 B 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:40:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 862
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 01:40:31 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/ Frame 961B 17 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab2acc5edb2198c0c0c25a5a4a470df2a048c69e982d11b4b96f22b21332fe2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 00:51:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7120
x-xss-protection: 0
server: cafe
etag: 14491782869175424788
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 00:51:16 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 961B 2 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:33:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1306
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 01:33:07 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 961B 118 KB
36 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e705dfac9d3d11ae87071979b2bbb52db73d03fff6252c1b73ce5b3c7ebb6e9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616585768493349"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36563
x-xss-protection: 0
expires: Thu, 25 Mar 2021 01:54:53 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/ Frame 961B 12 KB
5 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d890a48ea501050f8167a15968c0d8d1d654a54ce3058242ab99acdfb81e288

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2824
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5520
x-xss-protection: 0
server: cafe
etag: 4598867394938533942
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Apr 2021 01:07:49 GMT

GET
H3-Q050 200 957c89dfc9e78dd5a0a3956da91f5358.js Show response
www.gstatic.com/mysidia/ Frame 961B 25 KB
11 KB 34ms
19ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/957c89dfc9e78dd5a0a3956da91f5358.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74701d1b03dcb606710d7cc01bbf35a36ad5e5e443e33e55894a013f0d65aacf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 18 Mar 2021 10:35:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 12 Mar 2021 03:13:35 GMT
server: sffe
age: 573593
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10839
x-xss-protection: 0
expires: Wed, 16 Jun 2021 10:35:00 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5563666098633974283/ Frame 961B 9 KB
9 KB 6ms
6ms Image
image/png 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5563666098633974283/downsize_200k_v1?w=200&h=200

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43b0602730ce364bdcfca3816ee486a871fb329797704b7a222fcae85a5ee1b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 22 Mar 2021 06:35:05 GMT
x-content-type-options: nosniff
age: 242388
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8964
x-xss-protection: 0
last-modified: Wed, 14 Nov 2018 09:13:50 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 22 Mar 2022 06:35:05 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/4860707954263291712/ Frame 961B 189 KB
189 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4860707954263291712/downsize_200k_v1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc341b739b4904a74ad5bafb56d31fdd6b48048948f6a36ffbf0d7b68a56d947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 22 Mar 2021 06:35:54 GMT
x-content-type-options: nosniff
age: 242339
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 193474
x-xss-protection: 0
last-modified: Fri, 19 Mar 2021 09:12:58 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 22 Mar 2022 06:35:54 GMT

GET
DATA 200
OK truncated
/ Frame 961B 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1

200
OK

1x1.gif Show response
imagesrv.adition.com/ Frame 961B
Redirect Chain

https://ad2.adfarm1.adition.com/banner?sid=4593833&gdpr=&gdpr_consent=&kid=4247907&bid=13263779&wpt=C&ts=256887436&ipt=0
https://imagesrv.adition.com/1x1.gif

68 B
289 B

76ms
24ms

Fetch
image/gif

217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/1x1.gif
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 25 Mar 2021 01:54:53 GMT
Last-Modified: Fri, 24 Jul 2009 13:46:10 GMT
Accept-Ranges: bytes
ETag: "4251594642"
Content-Length: 68
Content-Type: image/gif

Redirect headers

Pragma: no-cache
Date: Thu, 25 Mar 2021 02:54:53 +0100
Server: ADITIONSERVER v1.0
Access-Control-Allow-Origin: *
ETag: 6943404302931264727
Transfer-Encoding: chunked
P3P: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Location: https://imagesrv.adition.com/1x1.gif
Cache-Control: no-cache
Connection: keep-alive
Content-Type: text/plain
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 961B 0
0 44ms
42ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C5s3GbO1bYNiOMtiGjuwPhYWmQJuv0fZh4_bk3cUN-f_X75MOEAEg84aaAmCVAqAB_d-enQPIAQmpAhgbWsB-0bM-qAMByAPLBKoE7gFP0B10qbt2HmO9SVwMyMtWNztOWwhy_F6AGU-Ba10aI3f55XRzmIuPX7WCuc6Az02epbHs5wT5vNnHcRi2zubx9cgfmSfrdifKAGhLN7SRwA9LXqn5pO660H9Ua-B5alt7cS6uJz_iil5NUiJ3OaRrCf1qMhYkDdxAXJGUvKaPAKhWOC9VWWAQaZb2p-MNPxw_cEXPX7whJqYvd6E4jbcXH3p9BvXJS_d00J4NmpJCEIKpMfynZo9qTX_J_NdH7_u28Y0JxP2C3mV1fgrDd3QNLtFaLFUCV-ngisSmZveLb2SufVJiHOiZkDYSz-qKwASHtJy3yAOSBQQIBBgBkgUECAUYBKAGLoAH65_hYqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBRCP_q4G0ggJCIDhgBAQARgfgAoByAsB2BMNiBQBshcaChgIABIUcHViLTExMDk0MDE5NjQ2MjM2NjQ&sigh=7bo65tZDYdc&template_id=484&tpd=AGWhJmtWRaqn_C5iXFZIi3nofsM3QffAHrCAX1iJcG1CWj2-BQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 25 Mar 2021 01:54:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A7DF
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
21 B

14ms
14ms

Document
text/html

2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=110019565&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292650&bpp=1&bdt=405&idt=145&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2B9xLFbYeH&p=https%3A//www.financialhealth.net&dtd=149

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkx8iuAht0dbs7WQgzP6enarTrJKurw87DVU788BRrrV6G7T37dI8bL0lIrzvY; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 25 Mar 2021 01:54:53 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Thu, 25-Mar-2021 02:54:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 25 Mar 2021 01:54:53 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 25 Mar 2021 01:54:53 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js Show response
pagead2.googlesyndication.com/bg/ Frame 2982 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20210322/r20110914/elements/html/bg_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9249fd9f8183f4e5e0ae23c3e24386fdd3c7e79ec3e788cb1f11483ce1a60a95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 23 Mar 2021 17:17:21 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 117452
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5656
x-xss-protection: 0
expires: Wed, 23 Mar 2022 17:17:21 GMT

GET
H3-Q050

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FFE6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
21 B

17ms
17ms

Document
text/html

2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkx8iuAht0dbs7WQgzP6enarTrJKurw87DVU788BRrrV6G7T37dI8bL0lIrzvY; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 25 Mar 2021 01:54:53 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Thu, 25-Mar-2021 02:54:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 25 Mar 2021 01:54:53 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 25 Mar 2021 01:54:53 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js Show response
pagead2.googlesyndication.com/bg/ Frame D19D 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9249fd9f8183f4e5e0ae23c3e24386fdd3c7e79ec3e788cb1f11483ce1a60a95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 23 Mar 2021 17:17:21 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 117452
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5656
x-xss-protection: 0
expires: Wed, 23 Mar 2022 17:17:21 GMT

GET
DATA 200
OK truncated
/ Frame 961B 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ff1398bc4cc427a05f62d237b6b1760e9ebb10d5fe19fbce70905d2739afedac

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 961B 15 KB
16 KB 33ms
20ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 24 Mar 2021 19:52:31 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:19:00 GMT
server: sffe
age: 21742
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15816
x-xss-protection: 0
expires: Thu, 24 Mar 2022 19:52:31 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 961B 15 KB
16 KB 30ms
19ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29f6da0a8c21c5681511bb9b08663d3fd2c5d09c9bd8054ec354c563b8c8b7c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 24 Mar 2021 22:41:50 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:55 GMT
server: sffe
age: 11583
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15784
x-xss-protection: 0
expires: Thu, 24 Mar 2022 22:41:50 GMT

GET
H3-Q050 200 kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js Show response
pagead2.googlesyndication.com/bg/ Frame 58F8 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4578670007&adk=2858824968&adf=2878050715&pi=t.ma~as.4578670007&w=640&lmt=1616637292&psa=0&format=640x300&url=https%3A%2F%2Fwww.financialhealth.net%2Fround-two-of-ppp-loans%2F%3Futm_placement%3Dfhn%26utm_source%3Dfinance-MB-f-on-hr-01-sui-03242021-8-AK-BD-&flash=0&wgl=1&dt=1616637292651&bpp=1&bdt=406&idt=152&shv=r20210322&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C640x300%2C640x300&nras=1&correlator=8662885653938&frm=20&pv=1&ga_vid=431683304.1616637293&ga_sid=1616637293&ga_hid=1600341097&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=294&ady=1525&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C44739391%2C44737458%2C44739387&oid=3&pvsid=2026075966189329&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=Kf2JjDqwS3&p=https%3A//www.financialhealth.net&dtd=155

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9249fd9f8183f4e5e0ae23c3e24386fdd3c7e79ec3e788cb1f11483ce1a60a95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 23 Mar 2021 17:17:21 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 117452
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5656
x-xss-protection: 0
expires: Wed, 23 Mar 2022 17:17:21 GMT

GET
H2 200 SaveDeviceId.js Show response
create.leadid.com/2.7.0/ Frame CFB5 0
302 B 321ms
109ms Script
text/javascript 52.5.64.242
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://create.leadid.com/2.7.0/SaveDeviceId.js?lac=EE9325A8-6663-59BB-1FFC-87C1636E50BC&lck=B881B1B2-DF71-39C9-45E8-E4CC7A9E35D3&methods=16&token=156F82D9-7AEC-351C-3F90-0A82D05D2F71&uuid=d100fd09a8b546a5a2de37cc71e0d48a
Requested by: Host: deviceid.trueleadid.com
URL: https://deviceid.trueleadid.com/iframe.html?token=156F82D9-7AEC-351C-3F90-0A82D05D2F71&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.7.0&lck=B881B1B2-DF71-39C9-45E8-E4CC7A9E35D3&lac=EE9325A8-6663-59BB-1FFC-87C1636E50BC
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.64.242 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-64-242.compute-1.amazonaws.com
Software: nginx/1.17.6 / PHP/7.1.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://deviceid.trueleadid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:54 GMT
content-encoding: gzip
server: nginx/1.17.6
x-powered-by: PHP/7.1.33
access-control-max-age: 1728000
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
6 KB 18ms
18ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210322&st=env

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c31c126e1b9fa7737b4bfeaf08d04672a1d057e9e264ddf52dc4addcd96ae4c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 25 Mar 2021 01:54:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6493
x-xss-protection: 0

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 01:54:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Thu, 25 Mar 2021 01:54:54 GMT

GET
H3-Q050 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame C384 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.financialhealth.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.financialhealth.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Wed, 24 Mar 2021 20:54:11 GMT
expires: Thu, 24 Mar 2022 20:54:11 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 18043
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js Show response
pagead2.googlesyndication.com/bg/ Frame C384 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/kkn9n4GD9OXgriPD4kOG_dPH557D54jLHxFIPOGmCpU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9249fd9f8183f4e5e0ae23c3e24386fdd3c7e79ec3e788cb1f11483ce1a60a95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 23 Mar 2021 17:17:21 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 117453
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5656
x-xss-protection: 0
expires: Wed, 23 Mar 2022 17:17:21 GMT

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6CB1 42 B
66 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstrpYGDKZ6m6LQFR_PQnjFuFch26_MYnS1K0998_22sYCd7V4rVn4CH8CdUOEkrGyIpzknpMMoTzP8T4V_Kn0K3J_Mkc6UVq1Ez9r4zKy_tPaMWMcDrOr2Z_6TQtQ&sai=AMfl-YTXGp4PfHOZjMwiGZxRjAVJ9v2-Vx59OP0Rd8H-f1rPlRPil_Jf6fdPesqtzo1Y7ucw-7xOgsu4B0iG&sig=Cg0ArKJSzHpGziA7x46mEAE&id=osdim&mcvt=1009&p=489,294,660,934&mtos=1009,1009,1009,1009,1009&tos=1009,0,0,0,0&v=20210324&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=2858824968&rs=2&met=mue&la=0&cr=0&osd=1&vs=4&rst=1616637292793&dlt=441&rpt=37&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 25 Mar 2021 01:54:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
46 B 40ms
39ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gda_r20210322&jk=2026075966189329&bg=!1Nel15PNAAbUo7L91KM7ACkAdvg8Wtd5IIOqgjEavocfsMda36Kxx2qj6inFqmC8ZGqDEqJhn1Ot9gIAAACZUgAAAA5oAQcKAEBWgou_-ElOm1_zxJVI0gXx0Lqlp9BipMKl_sPYt52Iuh76jvqxFBX9OtUvNYT7zwbEKC0VybteojPYPdhOdnUsmQHOs4t2vcf7n-3EDwCWflI72L30dSVNkMiTlZu1kVYcQPiKdBCVbX7x7XF0NY2zEDxeNLK-m2OHJtGXEB8SP3IuQ-bszRcfpRjrlvmLGY8dxr23FyRdSNwQQsYeg2Dd-BQe4nHXEWDpGZ4pEKeVowM_MgYpf-GAd6eqCPjgEg-zPdla6EDAKL0yCF-r4fIOcXEE9NNPbac0q6enhYaAVtQWb7xQSovRUDyOCI1FtKwvniNkQoah9BvCPvuVAmlP5xikICX2Gm8w8XRn_cGqDYZus0raEtc0lPmC9sgnJU8fyHp5TjXKFotg-olCVKxV2kwXS6jjNf-guuYXjsKdnNpQbWGV0Gmddoz6I6MuxxViAiM329SJhMkthDyVENYcJidyDRg41pCykRRQgv9urZI-ZYr8q_Qq5Pix9FUajH5O-iQZI2AeNQB3UHfvbv46bC33XH0ldk0XLeMiVzGi_p1OereRKbBXFB_RcLnepN8BOVvIz7tMWEv0xJlMJpS6HsXo_0_UAii5RyFI-JUtvILgfAL6Mc3KwgSWEXMp4IPrbm30c_nU_723gDYCd6dVckylWLa77RVWBjrks-P2eRZPNfvFuS7O0GdnZQhdtdvd

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 25 Mar 2021 01:54:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 754E 42 B
66 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss3DZHbIhiK3Ce9wSbviMpFt70Ljs4c6J8mU9k8317cBPa1ihTcz5hayMwxSxDqwkB_E0ZS8rp1plMk9hykky7MpYUu9Bb-q1FlmVzcgVzP4B7lAe83UZcbSIzLhA&sai=AMfl-YSI1pJBDX6KoPlBZ7a4XhmOaMLP5f2YpUpKQrkMSKl2najhHlwHds7QUTCqvyy6n9fKTAnrxkFaIzsg&sig=Cg0ArKJSzJ7ldkwpjIzJEAE&id=osdim&mcvt=1012&p=141,1022,391,1322&mtos=1012,1012,1012,1012,1012&tos=1012,0,0,0,0&v=20210324&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=2138847987&rs=2&met=mue&la=0&cr=0&osd=1&vs=4&rst=1616637292813&dlt=452&rpt=27&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 25 Mar 2021 01:54:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 Snap Show response
create.leadid.com/2.7.0/ 0
298 B 441ms
326ms XHR
text/plain 52.5.64.242
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://create.leadid.com/2.7.0/Snap?msn=4&pid=a4ef427a-36d2-46df-84fd-5247791258a5&token=156F82D9-7AEC-351C-3F90-0A82D05D2F71&_=744771317
Requested by: Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/b881b1b2-df71-39c9-45e8-e4cc7a9e35d3.js?snippet_version=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.64.242 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-64-242.compute-1.amazonaws.com
Software: nginx/1.17.6 / PHP/7.1.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 25 Mar 2021 01:54:55 GMT
content-encoding: gzip
server: nginx/1.17.6
x-powered-by: PHP/7.1.33
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 Snap Show response
create.leadid.com/2.7.0/ 0
298 B 395ms
228ms XHR
text/plain 52.5.64.242
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://create.leadid.com/2.7.0/Snap?msn=5&pid=a4ef427a-36d2-46df-84fd-5247791258a5&token=156F82D9-7AEC-351C-3F90-0A82D05D2F71&_=744771318
Requested by: Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/b881b1b2-df71-39c9-45e8-e4cc7a9e35d3.js?snippet_version=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.64.242 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-64-242.compute-1.amazonaws.com
Software: nginx/1.17.6 / PHP/7.1.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.financialhealth.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 25 Mar 2021 01:54:55 GMT
content-encoding: gzip
server: nginx/1.17.6
x-powered-by: PHP/7.1.33
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

199 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.deviceid.trueleadid.com/	1970-01-25 20:28:19	Name: uuid Value: d100fd09a8b546a5a2de37cc71e0d48a
.financialhealth.net/	1970-01-20 10:35:09	Name: _ga Value: GA1.2.431683304.1616637293
.doubleclick.net/	1970-01-19 17:03:58	Name: test_cookie Value: CheckForPermission
.doubleclick.net/	1970-01-19 17:04:00	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-20 02:25:33	Name: IDE Value: AHWqTUkx8iuAht0dbs7WQgzP6enarTrJKurw87DVU788BRrrV6G7T37dI8bL0lIrzvY
.financialhealth.net/	1970-01-19 19:13:33	Name: _fbp Value: fb.1.1616637292875.983000561
.financialhealth.net/	1970-01-19 17:05:23	Name: _gid Value: GA1.2.1915735882.1616637293
www.financialhealth.net/	1969-12-31 23:59:59	Name: leadid_token-EE9325A8-6663-59BB-1FFC-87C1636E50BC-B881B1B2-DF71-39C9-45E8-E4CC7A9E35D3 Value: 156F82D9-7AEC-351C-3F90-0A82D05D2F71
.financialhealth.net/	1970-01-20 02:25:33	Name: __gads Value: ID=cd7b5d174686bdcb-226ad4eb35a70042:T=1616637292:RT=1616637292:S=ALNI_MZnaY3_aQa1xi-X40tQeChd3RMWiQ
.financialhealth.net/	1970-01-19 17:03:57	Name: _gat_UA-101848309-1 Value: 1
.financialhealth.net/	1970-01-19 19:13:33	Name: _gcl_au Value: 1.1.1233940254.1616637293
.financialhealth.net/	1970-01-19 17:47:09	Name: __cfduid Value: dc03a6305c1112411d4872549ada5dc1e1616637292

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.financialhealth.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2(Line 2) Message: JQMIGRATE: Migrate is installed, version 3.3.2
console-api	log	URL: https://www.financialhealth.net/wp-content/plugins/earnware-connect/public/js/earnware-lib.js?ver=1.0.62(Line 3) Message: utm_placement origin overwritten
console-api	log	URL: https://www.financialhealth.net/wp-content/plugins/earnware-connect/public/js/earnware-lib.js?ver=1.0.62(Line 3) Message: utm_source origin overwritten

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

17m99yl.elnk1.com
ad2.adfarm1.adition.com
adservice.google.com
adservice.google.de
api.earnware.com
cdn2.lockerdomecdn.com
connect.facebook.net
create.leadid.com
create.lidstatic.com
d2m2wsoho8qq12.cloudfront.net
deviceid.trueleadid.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
imagesrv.adition.com
lockerdome.com
mikayla-baldwin.ontraport.com
pagead2.googlesyndication.com
partner.googleadservices.com
stats.g.doubleclick.net
tpc.googlesyndication.com
www.facebook.com
www.financialhealth.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
104.154.142.214
107.23.243.197
13.226.156.196
13.32.21.113
142.250.185.194
151.139.242.29
209.170.211.179
217.79.188.21
217.79.188.59
2606:4700:10::6816:27b6
2606:4700:10::6816:3e6b
2a00:1450:4001:800::2003
2a00:1450:4001:801::200e
2a00:1450:4001:802::2004
2a00:1450:4001:809::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:811::2002
2a00:1450:4001:811::2003
2a00:1450:4001:811::2004
2a00:1450:4001:812::2002
2a00:1450:4001:812::2003
2a00:1450:4001:827::2002
2a00:1450:4001:828::2008
2a00:1450:4001:828::200e
2a00:1450:4001:82a::2001
2a00:1450:4001:82a::200a
2a00:1450:400c:c0c::9a
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
35.173.69.178
52.5.64.242
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
166a4ec3cb90d525f7f744c7616c01b36bebd6dcecd486c8f5be14ccc0a7b3da
16739a26b8231da1d897cbe780cbc053c90eaf9491e7699e392aafbfdaf49c2f
17c017479dd90e883c66518bc09e8e77eb17fd4186fc172b5565e2014ad8e2e9
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1bfcd59fe380451c90d3d9d72a8dcd4ef7836c84654b758d7966395065dd1395
1ce8bffe9993debe0780d6912df0ac9350f43416d4a7f23c5fd86702281328dd
21179a2f74ea52ff3053b565400fad76c1b18f4b85b37d8fc0b786e05cd48d46
2168d2df51aaecddcc02caf4764bb76866ed07e0967f18dda16f5bf7ee058b10
24369e1b2461af9dcefecaf9cc93d64cf22a4c5bac32506100b9e21014507bcf
29778a6252b89c79ad8a313692c3f4b8ff5e300c463858732f28da488dd2cc05
29f6da0a8c21c5681511bb9b08663d3fd2c5d09c9bd8054ec354c563b8c8b7c1
2fc4a2079a70808f477b6e96837d6f8a539192aae036c9cb732c87554d915650
3981b09097f908c9ff786d4dc1ff753a846c25e9cbde3456ab17f713176b9118
3ab2acc5edb2198c0c0c25a5a4a470df2a048c69e982d11b4b96f22b21332fe2
3dd1fa07e4802c23e53915d6e8a450445a9c50efcada797976b64eff77fbb6bd
43afa903212857894391cd1020a11e1519b50097812701aa270fb975f4699bcd
43b0602730ce364bdcfca3816ee486a871fb329797704b7a222fcae85a5ee1b9
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
4946909cb0494ae08f1563fc323d2f252e388b05298c0fb01028df322696182b
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
4d890a48ea501050f8167a15968c0d8d1d654a54ce3058242ab99acdfb81e288
4e2d95df10e65f48daac2dcbad2cc0ef091610b5d5f77e4be8ad56a2e5aed241
557c7d8dd32557129cec3d5d4f221eef6e8706e0855f826f5f6db4278e08420b
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c1a9a763ad88572f9e0d64eee198386f3a4b560ceefd12a5e1032328e568bf0
5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c
60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
700e8ea9519fbadffcfb3395c4a3e3dcb7b92ae5eb3387aaedb4fc30ea0cf522
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
74701d1b03dcb606710d7cc01bbf35a36ad5e5e443e33e55894a013f0d65aacf
779b4e1918fa1b99b1ecd1fee9ce12a0419b5fed3084e20d161b1d62ba92f4a9
7ae5b52b01b37efb4547c3493f75abf51dc034326bb6f1ff6fc97348065716ba
7bc5cdc982210fa5f543ec21cb32c7246c3226cc4d48a525248df920af7eb107
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8e845b3c43da250d2131dcca1a9af77bdaca1b61f1215be6317f2d5f17f999e1
8f0722a81c1b03ebc18826f4f29bca688a1aee89619de0be687dde8c8fab0800
9249fd9f8183f4e5e0ae23c3e24386fdd3c7e79ec3e788cb1f11483ce1a60a95
9596c5ef43d18217545384f2acbae62e6bdfc2682494adbb3f129efb0f0282ab
95ac961a016051c48bc7e031957bf5c1b0cc2f50551725653efeebc56577fb76
9acc39648034c271183fcc522663eaacd49fc368734d99da2f6305ed615b3e5e
9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
ab21fef3ac4ee12ebb305942f85de99b290b8a24654c69060e54673d5f3a11f2
b10d18b41d70ac787cf65aedeacace35641b4fa8ff8bc2b21371799dbbe124b4
b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae
ba2d293f01789ef093b5b67ca430d9d1a95a5782e7f72e9b961163f4ba56f43b
bc341b739b4904a74ad5bafb56d31fdd6b48048948f6a36ffbf0d7b68a56d947
c31c126e1b9fa7737b4bfeaf08d04672a1d057e9e264ddf52dc4addcd96ae4c5
c44ef8885a1386dad99986e4de63457883d50b1a966d27b502f37d691d7bd770
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
cac02e231c61068da6a4e6c177f2ccd14a5360aa3509af3be992bfbbad0c127b
cd8b6069109cb27dee7a87bade1aa6190fd0b88df2971a117d92eb28a692f6bf
cf130af380b632a147b9a20af53c278309a601be5d51445f5a68da9af745f48b
cf879f269821507f6a580b554d6a3cb55e2bc575220d46610ae65fe4138e69ee
d344632c01d1ca55dc380216de660c9b8a5a3174e7d7afa6784aff50c945e1cc
d7246ea8f0ede1f2eadd6aa077545b7e0423f39e19d33c7c9a99d400afbe1bbb
ddf1f42a7bec68c72f80f6fecf6c7c3d934fff93d7aa035cff8468614c438d48
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3563bbdfe6b6dd91291e206740f7ce1398285b98a5972394847541cb4d89f29
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e47a27d91c2487289d6607ee10d7cb7b31944a5ed3ff5ffc86ec8526e9374af0
e705dfac9d3d11ae87071979b2bbb52db73d03fff6252c1b73ce5b3c7ebb6e9c
ed18c8f2da493ab85969d23f9f8f495c35eb3f29a35f66683ef4b3eb6da6ee43
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f9c9851fcbe69253eb4cfb15de9e08123f61d75ea590cdb4a297fd2074716e41
fdc604cdec66000a6ead0908e5aa504ed4a56aa21067c2d44eaf26bad3685a40
ff1398bc4cc427a05f62d237b6b1760e9ebb10d5fe19fbce70905d2739afedac
ffb443fb8f9f8551a45baac0c990456a32e3a671b36bd65f07d0a4a75b77c9c1

www.financialhealth.net Open in urlscan Pro 2606:4700:10::6816:3e6b Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

110 Requests

100 %HTTPS

65 %IPv6

23 Domains

29 Subdomains

27 IPs

3 Countries

1488 kBTransfer

4088 kBSize

12 Cookies

1 Outgoing links

Page URL History

Redirected requests

110 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.financialhealth.net Open in urlscan Pro
2606:4700:10::6816:3e6b Public Scan

Screenshot
Live screenshot

Full Image

110
Requests

100 %
HTTPS

65 %
IPv6

23
Domains

29
Subdomains

27
IPs

3
Countries

1488 kB
Transfer

4088 kB
Size

12
Cookies

110 HTTP transactions
6 data transactions