beautyticks.com Open in urlscan Pro
65.21.78.116 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://beautyticks.com/
Submission: On December 08 via manual (December 8th 2021, 5:48:10 pm UTC) from CA — Scanned from IT

Summary HTTP 232 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 27 IPs in 7 countries across 26 domains to perform 232 HTTP transactions. The main IP is 65.21.78.116, located in Helsinki, Finland and belongs to HETZNER-AS, DE. The main domain is beautyticks.com.
TLS certificate: Issued by R3 on October 28th 2021. Valid for: 3 months.

This is the only time beautyticks.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
47	65.21.78.116 65.21.78.116	24940 (HETZNER-AS) (HETZNER-AS)
5	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
53	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
4 11	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
40	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
2	142.250.185.195 142.250.185.195	15169 (GOOGLE) (GOOGLE)
2	142.250.181.227 142.250.181.227	15169 (GOOGLE) (GOOGLE)
7 23	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
4 8	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
4 6	185.33.221.88 185.33.221.88	29990 (ASN-APPNEX) (ASN-APPNEX)
9	2a00:1450:400... 2a00:1450:4001:82a::2006	15169 (GOOGLE) (GOOGLE)
4	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
1 1	52.18.11.109 52.18.11.109	16509 (AMAZON-02) (AMAZON-02)
1 1	18.196.159.27 18.196.159.27	16509 (AMAZON-02) (AMAZON-02)
2 3	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
4 4	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
4 4	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3 4	217.182.200.19 217.182.200.19	16276 (OVH) (OVH)
2	2620:116:800d... 2620:116:800d:21:5a23:9c4e:e774:96c1	16509 (AMAZON-02) (AMAZON-02)
2	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
2	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
2 2	8.39.36.141 8.39.36.141	26667 (RUBICONPR...) (RUBICONPROJECT)
232	27

47 65.21.78.116 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: static.116.78.21.65.clients.your-server.de

beautyticks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

53 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany) 4 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

40 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f3.1e100.net

p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f3.1e100.net

p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 142.250.185.66 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2.18.234.21 (Frankfurt am Main, Germany) 4 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.33.221.88 (Amsterdam, Netherlands) 4 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82a::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.18.98 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f98.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.11.109 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-11-109.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.196.159.27 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-159-27.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.215.191 (Frankfurt am Main, Germany) 4 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.64.190.78 (United Kingdom) 4 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 217.182.200.19 (France) 3 redirects

ASN16276 (OVH, FR)
PTR: gcm5.host.hit.gemius.pl

googlecm.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:5a23:9c4e:e774:96c1 (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 8.39.36.141 (Los Angeles, United States) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
68	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	634 KB
51	doubleclick.net 7 redirects googleads.g.doubleclick.net cm.g.doubleclick.net googleads4.g.doubleclick.net	270 KB
47	beautyticks.com beautyticks.com	719 KB
17	gstatic.com fonts.gstatic.com www.gstatic.com p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com	439 KB
13	google.com 4 redirects www.google.com adservice.google.com	38 KB
9	2mdn.net s0.2mdn.net	213 KB
8	casalemedia.com 4 redirects dsum-sec.casalemedia.com	7 KB
7	googletagservices.com www.googletagservices.com	256 KB
6	adnxs.com 4 redirects ib.adnxs.com	6 KB
5	googleapis.com fonts.googleapis.com	3 KB
4	gemius.pl 3 redirects googlecm.hit.gemius.pl	921 B
4	pubmatic.com 4 redirects image6.pubmatic.com	2 KB
4	addthis.com 4 redirects e.dlx.addthis.com	3 KB
3	rlcdn.com 2 redirects id.rlcdn.com	1 KB
2	rubiconproject.com 2 redirects pixel.rubiconproject.com	977 B
2	openx.net rtb.openx.net	486 B
2	mookie1.com odr.mookie1.com	430 B
2	quantserve.com cms.quantserve.com	926 B
2	google.it adservice.google.it	914 B
2	google-analytics.com www.google-analytics.com	20 KB
2	wp.com stats.wp.com pixel.wp.com	3 KB
1	agkn.com 1 redirects d.agkn.com	761 B
1	everesttech.net 1 redirects pixel.everesttech.net	376 B
1	googleadservices.com partner.googleadservices.com	648 B
1	googletagmanager.com www.googletagmanager.com	36 KB
0	atdmt.com Failed ad.atdmt.com Failed
232	26

	Domain	Requested by
47	beautyticks.com	beautyticks.com
40	tpc.googlesyndication.com	googleads.g.doubleclick.net beautyticks.com tpc.googlesyndication.com pagead2.googlesyndication.com
28	pagead2.googlesyndication.com	beautyticks.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com
24	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net beautyticks.com
23	cm.g.doubleclick.net	7 redirects googleads.g.doubleclick.net
11	www.google.com	4 redirects beautyticks.com www.gstatic.com www.google.com googleads.g.doubleclick.net tpc.googlesyndication.com
9	s0.2mdn.net	beautyticks.com s0.2mdn.net tpc.googlesyndication.com
8	dsum-sec.casalemedia.com	4 redirects googleads.g.doubleclick.net
7	www.googletagservices.com	googleads.g.doubleclick.net
7	www.gstatic.com	www.google.com www.gstatic.com googleads.g.doubleclick.net
6	ib.adnxs.com	4 redirects googleads.g.doubleclick.net
6	fonts.gstatic.com	fonts.googleapis.com www.google.com
5	fonts.googleapis.com	beautyticks.com googleads.g.doubleclick.net tpc.googlesyndication.com
4	googlecm.hit.gemius.pl	3 redirects beautyticks.com
4	image6.pubmatic.com	4 redirects
4	e.dlx.addthis.com	4 redirects
4	googleads4.g.doubleclick.net	beautyticks.com
3	id.rlcdn.com	2 redirects googleads.g.doubleclick.net
2	pixel.rubiconproject.com	2 redirects
2	rtb.openx.net	googleads.g.doubleclick.net
2	odr.mookie1.com	googleads.g.doubleclick.net
2	cms.quantserve.com	googleads.g.doubleclick.net
2	p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com	googleads.g.doubleclick.net p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com
2	p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com	googleads.g.doubleclick.net p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.it	pagead2.googlesyndication.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	d.agkn.com	1 redirects
1	pixel.everesttech.net	1 redirects
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	pixel.wp.com	beautyticks.com
1	stats.wp.com	beautyticks.com
1	www.googletagmanager.com	beautyticks.com
0	ad.atdmt.com Failed	googleads.g.doubleclick.net
232	34

This site contains links to these domains. Also see Links.

Domain
lankawebhosting.net

Subject Issuer	Validity	Valid
beautyticks.com R3	`2021-10-28` - `2022-01-26`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
www.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.it GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh

This page contains 36 frames:

Primary Page: https://beautyticks.com/
Frame ID: EBE2D9BE5017A9812650B06AB5A49D8F
Requests: 68 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20190131/zrt_lookup.html
Frame ID: 84653B2BAE5DA6E6B86A61A885F2FFD4
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdLOzkcAAAAAJNJ1xLiT4i0VDUH1HEEQg34yQ23&co=aHR0cHM6Ly9iZWF1dHl0aWNrcy5jb206NDQz&hl=it&v=_7Co1fh8iT2hcjvquYJ_3zSP&size=invisible&cb=7sox518vc2bt
Frame ID: CABAAAE8C165F6D66A4A544F2508B767
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&adk=1812271804&adf=3025194257&lmt=1638985683&plat=1%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fbeautyticks.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683037&bpp=2&bdt=465&idt=114&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4409203597798&frm=20&pv=2&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=132
Frame ID: A4FBE0F1ED76B2E22F0D9C5C3676BD2F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3332885161&adf=3836665116&pi=t.aa~a.3491345329~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=2&bdt=1198&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0&nras=2&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=pbV4puejKF&p=https%3A//beautyticks.com&dtd=20
Frame ID: F8854605A868CBE3BB97599FF8626B91
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3318186299&adf=167829604&pi=t.aa~a.264113679~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280&nras=3&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=1542&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=Vu61l8Z359&p=https%3A//beautyticks.com&dtd=66
Frame ID: ACEA30AC071C2C03606584CA14321391
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3288300619&adf=1514954413&pi=t.aa~a.1192212056~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250&nras=4&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=2141&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=BJloijK7qg&p=https%3A//beautyticks.com&dtd=74
Frame ID: 16A70AE6E03AB062786AA836084691D1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3584321639&adf=3048362026&pi=t.aa~a.2659481085~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250&nras=5&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=2405&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=PSI4l760Ij&p=https%3A//beautyticks.com&dtd=77
Frame ID: E8417220249D4A8268394FFC04941EB3
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=100&adk=3376572913&adf=109231892&pi=t.aa~a.2172648555~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x100&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=1&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250%2C390x280&nras=6&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=2826&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=yA85TodoMR&p=https%3A//beautyticks.com&dtd=82
Frame ID: FA13117B4A06F6839CA3DA2C8F4090B7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1
Frame ID: F705C0846757877EB503CBCAA5FF678C
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1
Frame ID: 1D70607DF865F1D84F16889C7C6787C5
Requests: 7 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: C4C4EE59461FBDF13B9A11B370BDBA4B
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: BFFF5CEE7FAC5810685713719959D6F8
Requests: 2 HTTP requests in this frame

Frame: https://p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Frame ID: FDCA424C9B7BFE8EB69C1E69C5A9A00B
Requests: 2 HTTP requests in this frame

Frame: https://p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Frame ID: 555F2154A9823A578BF5B9728C43D584
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js
Frame ID: CDEEF0714914D791B48A648C17E13D6C
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js
Frame ID: A33D80FCA97EE6B1A0AA1E2D6ACFB8A8
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYtKWdlwEwAQ&v=APEucNXDDLiajj84gi3dK92COjHiJvl_Bb8sHCGTKc7ztgLim0Tg3ajYl1zUaBVP8agJiApI3G4YHM9lv7kO0Xu6-mm3SZpLQ0pei1pmCvB6XDg2M_FlL-zePS8EbekLxhNqr2sP16D6DPL9-WYD5j-hT9E_AwFp2NCvMpx7iDIWySA1VyKYwMU
Frame ID: 16AFEA699E3F89F86C68D654C8DF4D3D
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYtKWdlwEwAQ&v=APEucNU9-OVbyFDfxIghfxvaI3nb-kM9f-BvhGTZ6leHoRyYnl-Ysv-vt6_vp6EIWdgVuoM557O2ZjisX1Ces50QgGdTLI_Jn9SmkQ5dufJ5JyMj9YucSaMQayS1mh5bTwzOPG_rSkRqPFB4ypbHkxzG0KKvGjfs3GDKC3GLUInAdQinJwf4-2E
Frame ID: 45B96762E871815C144A4D7DFA335B87
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/index.html
Frame ID: F8202C04E39E1FEE0A810F307D737F0D
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CzaLy0--wYbOoJe-HtOUPmeGc4AzA67PiZcqR8P7fDtrZHhABIO-o2X9g_YqihNQSoAG8wsvLA8gBCakC3XHCmhb4sj6oAwHIA0iqBNQBT9DZ2ugpLbfce_SseEeKqM_cUfv6BPKH6wb8HJD_BZXLJdHB3xnqxM-taKic6oNWHbaPMVVU5ehPQaVhWp6FlvlmxLdnsxOe0bdCYW9k7nTbYiPXcE51ARf8aWRzCuzj3ezUX5TClMzgCoZeLiT5Hsw990Y5b-K_Xm0I1nbVmBOwc8Zha3Juppwsl767EfLETxRA8yJVVW3-GailtX059wl4-L98FX4sHUlMznSh7mnhUwAWPE0D51fmKEJxF2UjotAPjzicO1yzI2XuwU2tNrjBorzABKnQ4JfiA5IFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAesvbQ0qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQqa0F0ggJCIDhgBAQARgfgAoByAsB2BMNiBQD0BUBmBYBgBcBshccChoIABIUcHViLTg2ODk0NjczNzI5NzQxODEYAA&sigh=DllOn-zAj2M&uach_m=[UACH]&template_id=419
Frame ID: 104AB26FCD56FED73FF4F9ED97EB5135
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 9315D9D49149EDF0622EDA7E076724EF
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 11C115B366303E69953CA383A5F178EF
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 596AD31801529003CB4F2D5A33C95A1A
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: E51A7EAF3FB8B3E7513B5971C4A81AB7
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html
Frame ID: E05519ABE2244C75DD13357D34719266
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CTf6k0--wYZ_1JZWH9APng7CoDpS8wfFfo-Od3c0Ox5nz-fwcEAEg76jZf2D9iqKE1BKgAa3xhrYCyAEJqQLbXYMmHPuyPqgDAcgDSKoE6AFP0OLLArWG88a8yeLIoG9xwoc3jnPDRgoipNVDvk-qI1zkdfz8YF5VK_l-PdbV1G7hvxe--D0hlG8y7rkjpbtZs4ovPudNCYKKjX0j8csIriqkbu9kyFLEhuj9Hi-4Z1bSxhipTSh-PTREwowxBd9xZ53UNViAhWh_C94iht4YfGR9JZDOWQHLdjxooWnY86VFTmlg6Rzhpq64IoDdto2DGY5hcywLPJi6wGl4u4-rR0MyggHc6oGpSv6oUwGHVdKdyU7bZXsGgHHxRnoaTQzRNOlNlBZxHwOEv3X8UMz3WSye3lwLNUBhwAT4hvWqtgOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHu475yQGoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBBDxngvSCAkIgOGAEBABGB-ACgHICwHYEwLQFQGAFwGyFxwKGggAEhRwdWItODY4OTQ2NzM3Mjk3NDE4MRgA&sigh=m1_L-JLQxhI&uach_m=[UACH]&template_id=419
Frame ID: 32B02190C9C6600D47662FEE98C2ED8D
Requests: 7 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/index.html
Frame ID: 66F431840A5E287F4156B89C54F12C1C
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: B1FA4C7ABB30BB7F5421D829628CFAAD
Requests: 2 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/index.html
Frame ID: C0D40B55D104D040F13442E304778CA4
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 181C2447CEB7B35FCB895D5BD7AE003A
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 8872CC9BEE048F6C4B811AD663F69FE9
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 0B6AC0B419EE8E7437EBC3035F8AE463
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js
Frame ID: CA7DD310E0884350E5ADC3D5B9C963B3
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 62695E85A94AEDA4BEE6F7A4FE1F4347
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0BC50CFBC7356C577FD104A290E2BF75
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Beauty Ticks -

Page Statistics

232
Requests

90 %
HTTPS

42 %
IPv6

26
Domains

34
Subdomains

27
IPs

7
Countries

2640 kB
Transfer

6398 kB
Size

32
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://lankawebhosting.net/
Title: lankawebhosting.net

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 101

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 119

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKDFPUlB4BwJcNZ_8g5kSPg&google_cver=1

Request Chain 120

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YbDv1K6GtmvEeL-N6tKSUQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMlq2tUU52ike68RV9VVM-g&google_cver=1

Request Chain 121

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEEeytP3tJOpZ-AECUalxGos&google_cver=1

Request Chain 122

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTY4NTE2ODM1OTMyNzY0NDk5NQ%3D%3D

Request Chain 123

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKDFPUlB4BwJcNZ_8g5kSPg&google_cver=1

Request Chain 124

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YbDv1K6GtmvEeL-N6tKSUQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMlq2tUU52ike68RV9VVM-g&google_cver=1

Request Chain 125

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEEeytP3tJOpZ-AECUalxGos&google_cver=1

Request Chain 126

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTY4NTE2ODM1OTMyNzY0NDk5NQ%3D%3D

Request Chain 175

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJjwsgmQgETvOsZ0pD_w9aaLfYJdti4y_zjxNtaVBcGfO98K0aFRTAENf82VB7FVeuSLqI4tWQe28EzN8o5C5bJ0JkLc4CO&google_gid=CAESEHCrj2Q_Y7T3Akq-FLlVBsQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWJEdjFBQUFCYnAwelFmeQ&google_push=AYg5qPJjwsgmQgETvOsZ0pD_w9aaLfYJdti4y_zjxNtaVBcGfO98K0aFRTAENf82VB7FVeuSLqI4tWQe28EzN8o5C5bJ0JkLc4CO

Request Chain 176

https://d.agkn.com/pixel/2175/?google_gid=CAESEL48pA-9-hl9mCXIMSTLGDs&google_cver=1&google_push=AYg5qPIYkh2_YOLIyu1ZpuyGCu_HiZ7KEPYHFGu9mzedcaMflbrUkPvVmoDe7AZ6J85YNCIvhGc-t7sW0kMZkdmDZAR9ALf9oqjv3w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIYkh2_YOLIyu1ZpuyGCu_HiZ7KEPYHFGu9mzedcaMflbrUkPvVmoDe7AZ6J85YNCIvhGc-t7sW0kMZkdmDZAR9ALf9oqjv3w&google_hm=Q0FFU0VMNDhwQS05LWhsOW1DWElNU1RMR0Rz

Request Chain 177

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPLNXOfYIyAWgvl801ETgFHaRdTMBfTSRcJAtAz13DJTiQ5-vOm2vCwQj8VKSuO6R9KogH6v5Q4PUesrsZMlyxL5V23S_LJHkQ&google_gid=CAESEEm07vMzu9KUpMKQ116IOHg&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCNTfw40GEgUI6AcQAEIASnJnb29nbGVfcHVzaD1BWWc1cVBMTlhPZllJeUFXZ3ZsODAxRVRnRkhhUmRUTUJmVFNSY0pBdEF6MTNESlRpUTUtdk9tMnZDd1FqOFZLU3VPNlI5S29nSDZ2NVE0UFVlc3JzWk1seXhMNVYyM1NfTEpIa1E HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwSUZkdGlRWFBKYVdMRzBCbmI0aGxSQnMyc0hlSzN6NXlvOVMyaUx6dlRIVQ==&google_push

Request Chain 178

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKvCpx8rq_LaiUYA__Y9FDUomn1-Nai-GKWhYpEy7zuIfBwGBUtYGB5OGbmal7TsONyKHGqm8-VtB91xwB9HN_i1_7SzvRp4A&google_gid=CAESEH1GOyqEYj9fI5LTyMQzH-g&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKvCpx8rq_LaiUYA__Y9FDUomn1-Nai-GKWhYpEy7zuIfBwGBUtYGB5OGbmal7TsONyKHGqm8-VtB91xwB9HN_i1_7SzvRp4A&google_gid=CAESEH1GOyqEYj9fI5LTyMQzH-g&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDgxNzQ4MDUwMDAzODgxNzk1ODk3NQ%3D%3D&google_push=AYg5qPKvCpx8rq_LaiUYA__Y9FDUomn1-Nai-GKWhYpEy7zuIfBwGBUtYGB5OGbmal7TsONyKHGqm8-VtB91xwB9HN_i1_7SzvRp4A

Request Chain 179

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESELFKHR2nMOi6hzU6HdY4MDE&google_cver=1&google_push=AYg5qPKZChwADwF8L71VH0Nz-fYYKOALZq_9A571okIn7jrLuwFiku26mHcxUmZVL0F_k5-B16RpzPN1q7X3gQ0BV0kIbkblP2jJ HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESELFKHR2nMOi6hzU6HdY4MDE&google_cver=1&google_push=AYg5qPKZChwADwF8L71VH0Nz-fYYKOALZq_9A571okIn7jrLuwFiku26mHcxUmZVL0F_k5-B16RpzPN1q7X3gQ0BV0kIbkblP2jJ&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=QOro0ZjAQvKXWZfqzLETYw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKZChwADwF8L71VH0Nz-fYYKOALZq_9A571okIn7jrLuwFiku26mHcxUmZVL0F_k5-B16RpzPN1q7X3gQ0BV0kIbkblP2jJ

Request Chain 180

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1

Request Chain 181

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEAphpZuqAntzk9LucHBYTsA&google_cver=1&google_push=AYg5qPJtvVZZlIIJumgWxSQF02eskDrNg7afGP-yIljGQ2jcIvyVY6nAHMe7CpAMEAUQSWXlPT_84Df_hHp7oO9zqj9dcAxzqldvq_k HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJtvVZZlIIJumgWxSQF02eskDrNg7afGP-yIljGQ2jcIvyVY6nAHMe7CpAMEAUQSWXlPT_84Df_hHp7oO9zqj9dcAxzqldvq_k&google_hm=

Request Chain 185

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIuxVgBh_A74DUNmCnvpbSmBj3fj5flFG0xQcK3XorlzaIDBh7R6vmxVhclBfmjbhfyZv5ReGtYAFqdCNCHiSzYBbs54KY6RKnixfKAmUYfd8G3U5SlRHEc9cgTcF5Ehs_srKzyERaXubsmYeNP1yI&google_gid=CAESEDTbfruNp-6OUSJsD2XF2Ew&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIuxVgBh_A74DUNmCnvpbSmBj3fj5flFG0xQcK3XorlzaIDBh7R6vmxVhclBfmjbhfyZv5ReGtYAFqdCNCHiSzYBbs54KY6RKnixfKAmUYfd8G3U5SlRHEc9cgTcF5Ehs_srKzyERaXubsmYeNP1yI&google_gid=CAESEDTbfruNp-6OUSJsD2XF2Ew&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDgxNzQ4MDUwMDA0ODA3OTg0NjE3NA%3D%3D&google_push=AYg5qPIuxVgBh_A74DUNmCnvpbSmBj3fj5flFG0xQcK3XorlzaIDBh7R6vmxVhclBfmjbhfyZv5ReGtYAFqdCNCHiSzYBbs54KY6RKnixfKAmUYfd8G3U5SlRHEc9cgTcF5Ehs_srKzyERaXubsmYeNP1yI

Request Chain 188

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEC6NZTHiI0FvIseAZE78K4k&google_cver=1&google_push=AYg5qPIrUXpzUYMrqfrG7VLgPNqaTVaFvL11h8Bej4anE97uv4MpiCB153YcrXA35-yapt_GJTL18R2sAavMa1Qbz9KGzSUbP3iTiHIgvR2h9_xZ_d-CPWdAyVdsi5P1OMl-Z0TAs7em6_U156cqd04ben0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dYVFJDS0gtMTgtRk9CVw==&google_push=AYg5qPIrUXpzUYMrqfrG7VLgPNqaTVaFvL11h8Bej4anE97uv4MpiCB153YcrXA35-yapt_GJTL18R2sAavMa1Qbz9KGzSUbP3iTiHIgvR2h9_xZ_d-CPWdAyVdsi5P1OMl-Z0TAs7em6_U156cqd04ben0

Request Chain 189

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEJevCCM9IRtCwdxbaDiVGFI&google_cver=1&google_push=AYg5qPJm7zgenk7ee4qsRG1F8wBGtGZr9L0V5KrzbIdxgiqwTCgaaMWcqIRXuGssJO4QEqfHUiWH_rQXdO4h3YEz-GZbave9JkW2JWhwfnAN8FivIWOO3IbfSY_IfuMund6mz60BP-DJ4CxyKwXFjPq7lM-V HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJm7zgenk7ee4qsRG1F8wBGtGZr9L0V5KrzbIdxgiqwTCgaaMWcqIRXuGssJO4QEqfHUiWH_rQXdO4h3YEz-GZbave9JkW2JWhwfnAN8FivIWOO3IbfSY&google_hm= HTTP 302
https://googlecm.hit.gemius.pl/dot.gif?id=pyM1l.MgAY658jQJ4ykHpoYhP_hR_2_qZ3eEDY6uHMX.C7&google_error=5

Request Chain 194

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJpiaSN-nylITTT0VdEjhRY&google_cver=1&google_push=AYg5qPKEBDkVMhBcQmOogL-aTfc6ykyjNhISBP49eqOkKgurbc30YKOxeAqHhjPU7P4knRZrEpXwa-xW7rF9gxPGm96Pl8EeHxGr HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJpiaSN-nylITTT0VdEjhRY&google_cver=1&google_push=AYg5qPKEBDkVMhBcQmOogL-aTfc6ykyjNhISBP49eqOkKgurbc30YKOxeAqHhjPU7P4knRZrEpXwa-xW7rF9gxPGm96Pl8EeHxGr&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=OFnYjFs_TuKbwVPLx5BHDw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKEBDkVMhBcQmOogL-aTfc6ykyjNhISBP49eqOkKgurbc30YKOxeAqHhjPU7P4knRZrEpXwa-xW7rF9gxPGm96Pl8EeHxGr

Request Chain 195

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPq_LXZ_lium2xSnMA4srP4&google_cver=1&google_push=AYg5qPKwt9ssBXdAm6BOIQhuRKhZs1EaAn0l0PPc3sG-e4EKB1wT2Z3PnSOaCZrmnM0UOdzmGaKl_S23CTWl-67ODqZW2O2QdqCb HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dYVFJDS0otMjEtR1pKNg==&google_push=AYg5qPKwt9ssBXdAm6BOIQhuRKhZs1EaAn0l0PPc3sG-e4EKB1wT2Z3PnSOaCZrmnM0UOdzmGaKl_S23CTWl-67ODqZW2O2QdqCb

Request Chain 196

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_cver=1&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM

Request Chain 197

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEF0gGaYcGhynpqoeJ07Hp8Y&google_cver=1&google_push=AYg5qPI3_ClLn-6IZF_ru2skA_yO-bj_a7CDrueuueHVW-qtir1Y3YOlGVyapu_ei8l3jKX-Ql0k2Z8PTZ0wsPdq75IPvG38Ha9ebg HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPI3_ClLn-6IZF_ru2skA_yO-bj_a7CDrueuueHVW-qtir1Y3YOlGVyapu_ei8l3jKX-Ql0k2Z8PTZ0wsPdq75IPvG38Ha9ebg&google_hm=

Request Chain 203

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 207

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 208

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

232 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
beautyticks.com/ 90 KB
12 KB 524ms
408ms Document
text/html 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 0906e1c88d296ae43c2ac5e213e7fd5bb474ff13ad15d3e9c61338a0de9dfe24

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9

Response headers

server: nginx
date: Wed, 08 Dec 2021 17:48:02 GMT
content-type: text/html; charset=UTF-8
content-length: 11635
link: <https://beautyticks.com/wp-json/>; rel="https://api.w.org/"
vary: Accept-Encoding,User-Agent
content-encoding: gzip

GET
H2 200 style.min.css
beautyticks.com/wp-includes/css/dist/block-library/ 79 KB
14 KB 62ms
61ms Stylesheet
text/css 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Tue, 31 Aug 2021 21:41:25 GMT
server: nginx
etag: W/"612ea205-13abe"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 mediaelementplayer-legacy.min.css
beautyticks.com/wp-includes/js/mediaelement/ 11 KB
3 KB 56ms
56ms Stylesheet
text/css 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Tue, 31 Aug 2021 21:41:21 GMT
server: nginx
etag: W/"612ea201-2bf8"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 wp-mediaelement.min.css
beautyticks.com/wp-includes/js/mediaelement/ 4 KB
1 KB 55ms
54ms Stylesheet
text/css 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=5.8.2
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Tue, 31 Aug 2021 21:41:21 GMT
server: nginx
etag: W/"612ea201-105a"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 styles.css
beautyticks.com/wp-content/plugins/contact-form-7/includes/css/ 3 KB
1 KB 62ms
61ms Stylesheet
text/css 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.5.3
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Thu, 02 Dec 2021 15:36:07 GMT
server: nginx
etag: W/"61a8e7e7-aab"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 style.css
beautyticks.com/wp-content/themes/colormag/ 78 KB
17 KB 95ms
94ms Stylesheet
text/css 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/style.css?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 64e6c847b43f135af65a335bdf981f8729399643a1b790bf492226f5db1a5b0e

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:44 GMT
server: nginx
etag: W/"61631264-1397e"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 dark.css
beautyticks.com/wp-content/themes/colormag/ 6 KB
1 KB 96ms
95ms Stylesheet
text/css 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/dark.css?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 7c6b5ac3afbbd8e5471899142a07880155a22391e9f40f031773447e86d46e18

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:45 GMT
server: nginx
etag: W/"61631265-191e"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 magnific-popup.min.css
beautyticks.com/wp-content/themes/colormag/js/magnific-popup/ 5 KB
2 KB 96ms
96ms Stylesheet
text/css 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/js/magnific-popup/magnific-popup.min.css?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: e529245e8867300ffd2b6f6c1e5b36d41ce8c71a9eb7cbdec52360c0be7b0017

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:46 GMT
server: nginx
etag: W/"61631266-1463"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 font-awesome.min.css
beautyticks.com/wp-content/themes/colormag/fontawesome/css/ 30 KB
8 KB 99ms
98ms Stylesheet
text/css 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/fontawesome/css/font-awesome.min.css?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 820e169ce24824066d9973fd4b6561aae9dcd6dbef6435da905d5a1d6482997c

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:44 GMT
server: nginx
etag: W/"61631264-791c"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 css
fonts.googleapis.com/ 5 KB
1 KB 117ms
49ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600&1&display=swap&ver=2.1.0

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

000f368e166bff7134f2c0ff890f75cd706b90c0de1a9a0be5d0c6f464d8c13e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Dec 2021 16:18:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 08 Dec 2021 17:48:02 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Dec 2021 17:48:02 GMT

GET
H2 200 jetpack.css
beautyticks.com/wp-content/plugins/jetpack/css/ 85 KB
21 KB 110ms
109ms Stylesheet
text/css 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/plugins/jetpack/css/jetpack.css?ver=10.3
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 41b60d2262cffca90f6cd644983a2d813336dc959558bdd6ae54b35ef06dd9fb

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Mon, 15 Nov 2021 18:28:55 GMT
server: nginx
etag: W/"6192a6e7-15494"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 jquery.min.js Show response
beautyticks.com/wp-includes/js/jquery/ 87 KB
35 KB 132ms
132ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Tue, 31 Aug 2021 21:41:21 GMT
server: nginx
etag: W/"612ea201-15db1"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 jquery-migrate.min.js Show response
beautyticks.com/wp-includes/js/jquery/ 11 KB
5 KB 147ms
146ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Tue, 31 Aug 2021 21:41:21 GMT
server: nginx
etag: W/"612ea201-2bd8"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 136ms
50ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-165678669-1

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

989319465c2fd25d9cc7d6583581b3f7dbf2ac1d251cfbec2ab2cac4b42d533d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36193
x-xss-protection: 0
last-modified: Wed, 08 Dec 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 08 Dec 2021 17:48:02 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 145 KB
51 KB 179ms
79ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6148d316fbd7ab6cb723e5beea0395bff6dbbd8cf60f541babb07947895bcda1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51947
x-xss-protection: 0
server: cafe
etag: 17035568802132320855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 08 Dec 2021 17:48:02 GMT

GET
H2 200 Hiru-logo-final-1.png
beautyticks.com/wp-content/uploads/2021/08/ 31 KB
31 KB 69ms
67ms Image
image/png 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/08/Hiru-logo-final-1.png
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 4cb82f16c2339cf8eae51d1b09f12ed1c0e7a9d89d9ee40ab04c754b8131dbb6

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Tue, 31 Aug 2021 21:39:18 GMT
server: nginx
accept-ranges: bytes
etag: "612ea186-7d1a"
content-length: 32026
content-type: image/png

GET
H2 200 wp-emoji-release.min.js Show response
beautyticks.com/wp-includes/js/ 18 KB
6 KB 73ms
71ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.2
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Tue, 31 Aug 2021 21:41:11 GMT
server: nginx
etag: W/"612ea1f7-4705"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 Hiru-logo-final-1-1-300x83.png
beautyticks.com/wp-content/uploads/2021/08/ 15 KB
15 KB 75ms
74ms Image
image/png 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/08/Hiru-logo-final-1-1-300x83.png
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 776b8865c56e24e7e18df37764348238e078750c462f21c985a98c55e3b039a7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Tue, 31 Aug 2021 21:39:18 GMT
server: nginx
accept-ranges: bytes
etag: "612ea186-3ccd"
content-length: 15565
content-type: image/png

GET
H2 200 regenerator-runtime.min.js Show response
beautyticks.com/wp-includes/js/dist/vendor/ 6 KB
3 KB 54ms
54ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.7
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: e87a1c5e24f9a7c7dcb437417f0b05b0a3c12947ce32d65c990c988a8b5ed4d7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Tue, 31 Aug 2021 21:41:27 GMT
server: nginx
etag: W/"612ea207-1906"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 wp-polyfill.min.js Show response
beautyticks.com/wp-includes/js/dist/vendor/ 16 KB
7 KB 66ms
65ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 293913879d30bab7499013e935009f5183facbddd63bfc9656a859622590b80b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Tue, 31 Aug 2021 21:41:27 GMT
server: nginx
etag: W/"612ea207-4056"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 index.js Show response
beautyticks.com/wp-content/plugins/contact-form-7/includes/js/ 12 KB
4 KB 56ms
54ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.5.3
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: d0ba7e2275cddbdf3d2473a60565d950efb8474ba7bda393cc64f56ff39d85ce

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Thu, 02 Dec 2021 15:36:07 GMT
server: nginx
etag: W/"61a8e7e7-2e56"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 jquery.bxslider.min.js Show response
beautyticks.com/wp-content/themes/colormag/js/ 23 KB
7 KB 58ms
55ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/js/jquery.bxslider.min.js?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 0157d11106d6b70289099fd1ce1f7bea3a9dfbb46cee3994edb07ce765bb92fc

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:46 GMT
server: nginx
etag: W/"61631266-5d92"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 jquery.sticky.min.js Show response
beautyticks.com/wp-content/themes/colormag/js/sticky/ 4 KB
2 KB 57ms
54ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/js/sticky/jquery.sticky.min.js?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: f9f94cc2cf984a2a8df89c1250c04396bc950e577b4143d5539ca88fb46de91b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:46 GMT
server: nginx
etag: W/"61631266-1087"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 jquery.newsTicker.min.js Show response
beautyticks.com/wp-content/themes/colormag/js/news-ticker/ 3 KB
1 KB 58ms
56ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/js/news-ticker/jquery.newsTicker.min.js?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 830afbea215ec452ea905a7e4705cf3ea2bad82c2278f755791d85be2d5e2eb1

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:46 GMT
server: nginx
etag: W/"61631266-d6d"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 jquery.magnific-popup.min.js Show response
beautyticks.com/wp-content/themes/colormag/js/magnific-popup/ 19 KB
8 KB 60ms
57ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/js/magnific-popup/jquery.magnific-popup.min.js?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: ea37b726a887afb5fc602e41e00d785142ad4db5f257009f4440d47850660445

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:46 GMT
server: nginx
etag: W/"61631266-4d9e"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 navigation.min.js Show response
beautyticks.com/wp-content/themes/colormag/js/ 2 KB
827 B 59ms
56ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/js/navigation.min.js?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 5b84335d42b38d3122349f53b20dd6a5cb0f45d1e45e5683fd572bcdda8c04a2

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:46 GMT
server: nginx
etag: W/"61631266-61f"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 jquery.fitvids.min.js Show response
beautyticks.com/wp-content/themes/colormag/js/fitvids/ 2 KB
933 B 60ms
58ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/js/fitvids/jquery.fitvids.min.js?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 8994924c0f3ab4474ee0a7c04417ad84933c4467cc9192fcb60b9774f15f5990

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:46 GMT
server: nginx
etag: W/"61631266-6da"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 skip-link-focus-fix.min.js Show response
beautyticks.com/wp-content/themes/colormag/js/ 325 B
457 B 60ms
58ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/js/skip-link-focus-fix.min.js?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 53f829ae556bf7011727483015d83a98bcdb4b5796eecb728827c1282c971536

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:45 GMT
server: nginx
etag: "145-5ce01f77ca75c-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
x-accel-version: 0.01
accept-ranges: bytes
content-length: 242

GET
H2 200 colormag-custom.min.js Show response
beautyticks.com/wp-content/themes/colormag/js/ 3 KB
1 KB 61ms
58ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/js/colormag-custom.min.js?ver=2.1.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 2b32be0979cb9f2119bd22563ed89560525c15a8edfd6e662a1968314783f689

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Sun, 10 Oct 2021 16:18:45 GMT
server: nginx
etag: W/"61631265-b0a"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 wp-embed.min.js Show response
beautyticks.com/wp-includes/js/ 1 KB
919 B 61ms
59ms Script
application/javascript 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-includes/js/wp-embed.min.js?ver=5.8.2
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
last-modified: Tue, 31 Aug 2021 21:41:12 GMT
server: nginx
etag: W/"612ea1f8-592"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 e-202149.js Show response
stats.wp.com/ 9 KB
3 KB 54ms
17ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202149.js
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT mxp
date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: br
server: nginx
etag: W/"6197c5cf-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sun, 27 Nov 2022 23:00:27 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 884 B
998 B 109ms
42ms Script
text/javascript 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LdLOzkcAAAAAJNJ1xLiT4i0VDUH1HEEQg34yQ23

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

222db01a050a707c43dd69b0e321cf5c8839ab56cea8032054cf082429a6693c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 585
x-xss-protection: 1; mode=block
expires: Wed, 08 Dec 2021 17:48:02 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v27/ 44 KB
44 KB 90ms
26ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600&1&display=swap&ver=2.1.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://beautyticks.com
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 13:52:02 GMT
x-content-type-options: nosniff
age: 446160
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44656
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:30:43 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 03 Dec 2022 13:52:02 GMT

GET
H2 200 fontawesome-webfont.woff2
beautyticks.com/wp-content/themes/colormag/fontawesome/fonts/ 75 KB
76 KB 64ms
64ms Font
font/woff2 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://beautyticks.com/wp-content/themes/colormag/fontawesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/wp-content/themes/colormag/fontawesome/css/font-awesome.min.css?ver=2.1.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://beautyticks.com/wp-content/themes/colormag/fontawesome/css/font-awesome.min.css?ver=2.1.0
Origin: https://beautyticks.com
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 10 Oct 2021 16:18:45 GMT
server: nginx
accept-ranges: bytes
etag: "61631265-12d68"
content-length: 77160
content-type: font/woff2

GET
H2 200 Results-of-Fasting-on-Physique-800x445.jpg
beautyticks.com/wp-content/uploads/2021/12/ 59 KB
59 KB 63ms
54ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/12/Results-of-Fasting-on-Physique-800x445.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 30d4eaccf2cb8cdd912abae65645fa1e3e56c3a7e4d5f86349b93a859f6f9665

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 05 Dec 2021 01:56:59 GMT
server: nginx
accept-ranges: bytes
etag: "61ac1c6b-ecd2"
content-length: 60626
content-type: image/jpeg

GET
H2 200 Why-Is-Blood-Strain-Management-Much-less-Probably-800x445.jpg
beautyticks.com/wp-content/uploads/2021/12/ 43 KB
43 KB 80ms
72ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/12/Why-Is-Blood-Strain-Management-Much-less-Probably-800x445.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 7cba571f7afecf1731afb7be93831b349af7dd12e87a33818b2bcd1de82e86a2

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 05 Dec 2021 02:04:21 GMT
server: nginx
accept-ranges: bytes
etag: "61ac1e25-aa79"
content-length: 43641
content-type: image/jpeg

GET
H2 200 The-Final-Pores-and-skin-Magnificence-Routine-Day-Evening-392x272.jpg
beautyticks.com/wp-content/uploads/2021/11/ 19 KB
19 KB 95ms
86ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/The-Final-Pores-and-skin-Magnificence-Routine-Day-Evening-392x272.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 8ef7c48a57b4bf2ac39e22b4a4ca973c9bc6e90f35499f2b39ffcac86c0dedce

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Mon, 22 Nov 2021 16:10:20 GMT
server: nginx
accept-ranges: bytes
etag: "619bc0ec-4ce7"
content-length: 19687
content-type: image/jpeg

GET
H2 200 Depth-Take-a-look-at-This-Soothing-and-Therapeutic-Oil-392x272.jpg
beautyticks.com/wp-content/uploads/2021/11/ 30 KB
31 KB 96ms
88ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/Depth-Take-a-look-at-This-Soothing-and-Therapeutic-Oil-392x272.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 073840357f79938256118053474b7331a023ae709b009cdf319301a67c43bb56

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Mon, 22 Nov 2021 16:22:45 GMT
server: nginx
accept-ranges: bytes
etag: "619bc3d5-799c"
content-length: 31132
content-type: image/jpeg

GET
H2 200 Nina-Dobrev-10-Minute-Beauty-Routine-392x272.png
beautyticks.com/wp-content/uploads/2021/11/ 135 KB
135 KB 109ms
101ms Image
image/png 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/Nina-Dobrev-10-Minute-Beauty-Routine-392x272.png
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 6c693f1bfd009b9ae853e1cf602e031862b1c7aa05e50fdb48c916ff55b3118a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 14 Nov 2021 23:26:48 GMT
server: nginx
accept-ranges: bytes
etag: "61919b38-21aab"
content-length: 137899
content-type: image/png

GET
H2 200 October-Makeup-Favorites-392x272.jpg
beautyticks.com/wp-content/uploads/2021/11/ 33 KB
34 KB 127ms
119ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/October-Makeup-Favorites-392x272.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 5bdc02ff4bf42419c115794478d5ac595e8ebda5501367516c59eeafb3c654eb

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 14 Nov 2021 22:52:46 GMT
server: nginx
accept-ranges: bytes
etag: "6191933e-85a5"
content-length: 34213
content-type: image/jpeg

GET
H2 200 The-Final-Pores-and-skin-Magnificence-Routine-Day-Evening-390x205.jpg
beautyticks.com/wp-content/uploads/2021/11/ 15 KB
15 KB 130ms
122ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/The-Final-Pores-and-skin-Magnificence-Routine-Day-Evening-390x205.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: f731b6f1d0931b5db76cee766b055f1068b91d807a606812ff1f3150c25fd9ab

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Mon, 22 Nov 2021 16:10:20 GMT
server: nginx
accept-ranges: bytes
etag: "619bc0ec-3cab"
content-length: 15531
content-type: image/jpeg

GET
H2 200 Depth-Take-a-look-at-This-Soothing-and-Therapeutic-Oil-130x90.jpg
beautyticks.com/wp-content/uploads/2021/11/ 5 KB
5 KB 129ms
123ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/Depth-Take-a-look-at-This-Soothing-and-Therapeutic-Oil-130x90.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: ef125e2c4198517761319d28b80173b5dc1357fb3076fbdcc6a21868c913b9e2

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Mon, 22 Nov 2021 16:22:45 GMT
server: nginx
accept-ranges: bytes
etag: "619bc3d5-13ed"
content-length: 5101
content-type: image/jpeg

GET
H2 200 Nina-Dobrev-10-Minute-Beauty-Routine-130x90.png
beautyticks.com/wp-content/uploads/2021/11/ 21 KB
21 KB 136ms
130ms Image
image/png 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/Nina-Dobrev-10-Minute-Beauty-Routine-130x90.png
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 06580faeade620264f91c139f7b4089f147197006169c9a9fcb06dd9c1406d7d

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 14 Nov 2021 23:26:48 GMT
server: nginx
accept-ranges: bytes
etag: "61919b38-54a4"
content-length: 21668
content-type: image/png

GET
H2 200 October-Makeup-Favorites-130x90.jpg
beautyticks.com/wp-content/uploads/2021/11/ 5 KB
5 KB 136ms
130ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/October-Makeup-Favorites-130x90.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 3f01ce846de825565cf6f7ccfbd14fc54758cb8a0a05944f8762e48f5cf0d199

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 14 Nov 2021 22:52:46 GMT
server: nginx
accept-ranges: bytes
etag: "6191933e-12e4"
content-length: 4836
content-type: image/jpeg

GET
H2 200 miss-dior-rose-roses-130x90.jpg
beautyticks.com/wp-content/uploads/2021/11/ 5 KB
5 KB 137ms
131ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/miss-dior-rose-roses-130x90.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 2ab780a46819e537adac4580247dc093275aef9b87f2a924cbc06a226e62754a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 14 Nov 2021 22:11:54 GMT
server: nginx
accept-ranges: bytes
etag: "619189aa-13d5"
content-length: 5077
content-type: image/jpeg

GET
H2 200 Results-of-Fasting-on-Physique-390x205.jpg
beautyticks.com/wp-content/uploads/2021/12/ 18 KB
18 KB 137ms
131ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/12/Results-of-Fasting-on-Physique-390x205.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: f1705ddc5eaff21e32e90d904b8a188e7c3979eece891e28416f7246fd3b2f51

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 05 Dec 2021 01:56:59 GMT
server: nginx
accept-ranges: bytes
etag: "61ac1c6b-4901"
content-length: 18689
content-type: image/jpeg

GET
H2 200 Why-Is-Blood-Strain-Management-Much-less-Probably-130x90.jpg
beautyticks.com/wp-content/uploads/2021/12/ 3 KB
4 KB 138ms
132ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/12/Why-Is-Blood-Strain-Management-Much-less-Probably-130x90.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 255baadf76fe64f37128b8cb709186a0f52109944a3e05e018d8feb51e01485c

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 05 Dec 2021 02:04:21 GMT
server: nginx
accept-ranges: bytes
etag: "61ac1e25-db1"
content-length: 3505
content-type: image/jpeg

GET
H2 200 High-Ideas-For-Residing-A-Wholesome-Way-of-life-130x90.jpg
beautyticks.com/wp-content/uploads/2021/12/ 5 KB
5 KB 136ms
132ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/12/High-Ideas-For-Residing-A-Wholesome-Way-of-life-130x90.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 5cc6db800aa7e986fd076fff9836a3bca9a627b4c9d6431584b6d18ab7b5960b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 05 Dec 2021 02:13:07 GMT
server: nginx
accept-ranges: bytes
etag: "61ac2033-12d2"
content-length: 4818
content-type: image/jpeg

GET
H2 200 Wholesome-Life-style-and-Weight-Loss-130x90.jpg
beautyticks.com/wp-content/uploads/2021/12/ 5 KB
5 KB 136ms
132ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/12/Wholesome-Life-style-and-Weight-Loss-130x90.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 448e21a77621fdfcdc1562da7cde90266ab2ee84c1669ae6c322ceae60310dab

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 05 Dec 2021 02:20:21 GMT
server: nginx
accept-ranges: bytes
etag: "61ac21e5-142b"
content-length: 5163
content-type: image/jpeg

GET
H2 200 The-Health-Growth-390x205.jpg
beautyticks.com/wp-content/uploads/2021/11/ 20 KB
20 KB 137ms
133ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/The-Health-Growth-390x205.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: df2b5282f28c9151bac3d100df49ed5e7f94daa4eb2229f203d02e559bd57a47

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Thu, 25 Nov 2021 17:50:00 GMT
server: nginx
accept-ranges: bytes
etag: "619fccc8-503e"
content-length: 20542
content-type: image/jpeg

GET
H2 200 Buff-Woman-Courting-Three-Issues-Not-To-Do-With-A-Buff-Babe-130x90.jpg
beautyticks.com/wp-content/uploads/2021/11/ 3 KB
3 KB 137ms
134ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/Buff-Woman-Courting-Three-Issues-Not-To-Do-With-A-Buff-Babe-130x90.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 5ef79c6b8a7681a21274798950b8e72bcbd5c73e1f0248f33da5c83d2e841ed5

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Thu, 25 Nov 2021 17:43:49 GMT
server: nginx
accept-ranges: bytes
etag: "619fcb55-b1b"
content-length: 2843
content-type: image/jpeg

GET
H2 200 5-Methods-to-Promote-a-Health-Way-of-life-in-Your-Office-800x445-130x90.jpg
beautyticks.com/wp-content/uploads/2021/11/ 4 KB
4 KB 138ms
134ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/5-Methods-to-Promote-a-Health-Way-of-life-in-Your-Office-800x445-130x90.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: eaef3ed4c6c553c79ef768c9548b2fd82074f9dcdd1ddd2f89a6422291c4ff34

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Sun, 28 Nov 2021 19:18:36 GMT
server: nginx
accept-ranges: bytes
etag: "61a3d60c-1123"
content-length: 4387
content-type: image/jpeg

GET
H2 200 Get-Ripped-With-Acai-Berry-Create-Irresistible-Six-Pack-Abs-This-12-months-Utilizing-Acai-Berry-Dietary-supplements-130x90.jpg
beautyticks.com/wp-content/uploads/2021/11/ 4 KB
4 KB 137ms
134ms Image
image/jpeg 65.21.78.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beautyticks.com/wp-content/uploads/2021/11/Get-Ripped-With-Acai-Berry-Create-Irresistible-Six-Pack-Abs-This-12-months-Utilizing-Acai-Berry-Dietary-supplements-130x90.jpg
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.78.116 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.78.21.65.clients.your-server.de
Software: nginx /
Resource Hash: 27f5a942212097396bcba5de0bb2b4be709098b1cd8ce8e30e7c785166b7789d

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
last-modified: Tue, 23 Nov 2021 19:42:59 GMT
server: nginx
accept-ranges: bytes
etag: "619d4443-f9d"
content-length: 3997
content-type: image/jpeg

GET
H2 200 recaptcha__it.js Show response
www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/ 345 KB
136 KB 92ms
27ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/recaptcha__it.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LdLOzkcAAAAAJNJ1xLiT4i0VDUH1HEEQg34yQ23

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a9832e8fbf9271704a38054b70a3623cc10a16404d01d23133ea1708c470f28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://beautyticks.com/
Origin: https://beautyticks.com
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 17:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 174439
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 138464
x-xss-protection: 0
last-modified: Mon, 15 Nov 2021 05:04:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="recaptcha"
expires: Tue, 06 Dec 2022 17:20:43 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 16ms
16ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A10.3&blog=197181366&post=0&tz=0&srv=beautyticks.com&host=beautyticks.com&ref=&fcp=790&rand=0.21377325335978425
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 08 Dec 2021 17:48:02 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 100ms
26ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-165678669-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 2815
date: Wed, 08 Dec 2021 17:01:07 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 08 Dec 2021 19:01:07 GMT

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/ 273 KB
99 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8689467372974181&plah=beautyticks.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1c3ff119553175f2cf19f85d9d1b72f552a0aa742363148bc2e75387cf579b5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100886
x-xss-protection: 0
server: cafe
etag: 13224104846250443628
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 08 Dec 2021 17:48:02 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211206/r20190131/ Frame 8465 11 KB
5 KB 27ms
26ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211206/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d853164105815c3ea423a95f095ee531f547ff1e12fba56a80be0f712c62929e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 07 Dec 2021 19:03:43 GMT
expires: Tue, 21 Dec 2021 19:03:43 GMT
content-type: text/html; charset=UTF-8
etag: 17731914101004188133
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4884
x-xss-protection: 0
age: 81859
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame CABA 39 KB
20 KB 87ms
51ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdLOzkcAAAAAJNJ1xLiT4i0VDUH1HEEQg34yQ23&co=aHR0cHM6Ly9iZWF1dHl0aWNrcy5jb206NDQz&hl=it&v=_7Co1fh8iT2hcjvquYJ_3zSP&size=invisible&cb=7sox518vc2bt

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/recaptcha__it.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

19a9b17ef063ede8dcc95a2bde8a6a81ea539d3ee96c9d3d31d86c0357ae47dc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-edhH/J732DErBZpN6xFFXA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 08 Dec 2021 17:48:02 GMT
content-security-policy: script-src 'report-sample' 'nonce-edhH/J732DErBZpN6xFFXA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 20198
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 69ms
34ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&aip=1&a=1835361440&t=pageview&_s=1&dl=https%3A%2F%2Fbeautyticks.com%2F&ul=en-us&de=UTF-8&dt=Beauty%20Ticks%20-&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=54411794&gjid=732913804&cid=1468423062.1638985683&tid=UA-165678669-1&_gid=1789276782.1638985683&_r=1&gtm=2ouc10&z=1117472273

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://beautyticks.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://beautyticks.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 219 B
648 B 150ms
40ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=beautyticks.com&callback=_gfp_s_&client=ca-pub-8689467372974181

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8689467372974181&plah=beautyticks.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

9dea96a664844dd84dd4e2b6b22cd64ff379b9389e7499db8f3491e4892938eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 204
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.it/adsid/ 107 B
792 B 124ms
36ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.it/adsid/integrator.js?domain=beautyticks.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 134ms
44ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=beautyticks.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Dec 2021 17:48:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 60ms
59ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fbeautyticks.com%2F&tn=DIV&cls=grecaptcha-badge&ign=false&pw=1600&ph=1200&x=1575&y=1175

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A4FB 267 KB
62 KB 504ms
504ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&adk=1812271804&adf=3025194257&lmt=1638985683&plat=1%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fbeautyticks.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683037&bpp=2&bdt=465&idt=114&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4409203597798&frm=20&pv=2&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=132

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0c8dbd16ed52c5a11fe7116329ea9a70393e72ad59a856a98814e15a51bdfdae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Dec 2021 17:48:03 GMT
server: cafe
content-length: 63625
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Dec 2021 17:48:03 GMT
cache-control: private

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/ Frame CABA 51 KB
24 KB 61ms
27ms Stylesheet
text/css 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdLOzkcAAAAAJNJ1xLiT4i0VDUH1HEEQg34yQ23&co=aHR0cHM6Ly9iZWF1dHl0aWNrcy5jb206NDQz&hl=it&v=_7Co1fh8iT2hcjvquYJ_3zSP&size=invisible&cb=7sox518vc2bt

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

509bf9e83d3ca5add614196c02c8e0ce59731d3d1a10552c944b74d86019d866

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 15:26:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8467
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24065
x-xss-protection: 0
last-modified: Mon, 15 Nov 2021 05:04:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="recaptcha"
expires: Thu, 08 Dec 2022 15:26:55 GMT

GET
H3 200 recaptcha__it.js Show response
www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/ Frame CABA 345 KB
135 KB 74ms
41ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/recaptcha__it.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a9832e8fbf9271704a38054b70a3623cc10a16404d01d23133ea1708c470f28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 17:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 174439
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 138464
x-xss-protection: 0
last-modified: Mon, 15 Nov 2021 05:04:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="recaptcha"
expires: Tue, 06 Dec 2022 17:20:43 GMT

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame CABA 2 KB
2 KB 26ms
26ms Image
image/png 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 03:05:30 GMT
x-content-type-options: nosniff
age: 52953
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="recaptcha"
expires: Wed, 15 Dec 2021 03:05:30 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame CABA 15 KB
15 KB 61ms
27ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Dec 2021 17:06:41 GMT
x-content-type-options: nosniff
age: 88882
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 07 Dec 2022 17:06:41 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame CABA 15 KB
15 KB 64ms
30ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Dec 2021 14:17:54 GMT
x-content-type-options: nosniff
age: 99009
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 07 Dec 2022 14:17:54 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame CABA 102 B
134 B 35ms
35ms Other
text/javascript 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=it&v=_7Co1fh8iT2hcjvquYJ_3zSP

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

78a24a370ca388d2a349ee51a39f64c2eaad33e8c49e74238d30d6c25ac24426

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdLOzkcAAAAAJNJ1xLiT4i0VDUH1HEEQg34yQ23&co=aHR0cHM6Ly9iZWF1dHl0aWNrcy5jb206NDQz&hl=it&v=_7Co1fh8iT2hcjvquYJ_3zSP&size=invisible&cb=7sox518vc2bt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Wed, 08 Dec 2021 17:48:03 GMT

POST
H3 200 reload Show response
www.google.com/recaptcha/api2/ Frame CABA 29 KB
16 KB 78ms
78ms XHR
application/json 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6LdLOzkcAAAAAJNJ1xLiT4i0VDUH1HEEQg34yQ23

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/recaptcha__it.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d390c3643d82a2838c602d43b72487998c4967ed8b031576b9034283049dd3c3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdLOzkcAAAAAJNJ1xLiT4i0VDUH1HEEQg34yQ23&co=aHR0cHM6Ly9iZWF1dHl0aWNrcy5jb206NDQz&hl=it&v=_7Co1fh8iT2hcjvquYJ_3zSP&size=invisible&cb=7sox518vc2bt
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Wed, 08 Dec 2021 17:48:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16331
x-xss-protection: 1; mode=block
expires: Wed, 08 Dec 2021 17:48:03 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/ 148 KB
53 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/reactive_library_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fab1350afa3d34e46c174b572091f61bd4359524f16a3530621194c35c27bfe9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53782
x-xss-protection: 0
server: cafe
etag: 8817098736720698532
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Dec 2021 17:48:03 GMT

GET
H3 200 integrator.js Show response
adservice.google.it/adsid/ 107 B
122 B 76ms
39ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.it/adsid/integrator.js?domain=beautyticks.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Dec 2021 17:48:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 84ms
40ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=beautyticks.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Dec 2021 17:48:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F885 17 KB
10 KB 803ms
802ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3332885161&adf=3836665116&pi=t.aa~a.3491345329~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=2&bdt=1198&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0&nras=2&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=pbV4puejKF&p=https%3A//beautyticks.com&dtd=20

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2da4f788289b5237b7398c2e9e3bf4ce88b135b4103a972b1a55383b2644b166

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
content-length: 9859
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Dec 2021 17:48:04 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame ACEA 74 KB
29 KB 885ms
884ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3318186299&adf=167829604&pi=t.aa~a.264113679~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280&nras=3&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=1542&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=Vu61l8Z359&p=https%3A//beautyticks.com&dtd=66

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

890ccf25958f71ece3221ae1b3b9954ef17ff78f00aa20ed3d5fe83d04dd0875

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
content-length: 29686
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Dec 2021 17:48:04 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 16A7 124 KB
40 KB 866ms
866ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3288300619&adf=1514954413&pi=t.aa~a.1192212056~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250&nras=4&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=2141&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=BJloijK7qg&p=https%3A//beautyticks.com&dtd=74

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

edf223f145e0fd4b472d360947a832ac233dd950919298ae1c518776ff71e00c

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPPd2rvh1PQCFe8DrQYdmTAHzA&gqi=0--wYdHKIMXH1fAPqKWc8As&layout=/sadbundle/%24csp%253Der3%24/14967257856070586351/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPPd2rvh1PQCFe8DrQYdmTAHzA&gqi=0--wYdHKIMXH1fAPqKWc8As&layout=/sadbundle/%24csp%253Der3%24/14967257856070586351/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
content-length: 41417
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Dec 2021 17:48:04 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E841 17 KB
9 KB 754ms
753ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3584321639&adf=3048362026&pi=t.aa~a.2659481085~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250&nras=5&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=2405&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=PSI4l760Ij&p=https%3A//beautyticks.com&dtd=77

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

853bc22314880268a561a0ac05d0bbe28e62b13bcda2a6fbd632b71fe4827857

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
content-length: 9542
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Dec 2021 17:48:04 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame FA13 124 KB
40 KB 924ms
924ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=100&adk=3376572913&adf=109231892&pi=t.aa~a.2172648555~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x100&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=1&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250%2C390x280&nras=6&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=2826&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=yA85TodoMR&p=https%3A//beautyticks.com&dtd=82

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

759423d45d67bb8220a1a2b75439a21b0f2a1852b158e38d3e375afa9f6923d7

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CN-q27vh1PQCFZUDfQod5wEM5Q&gqi=0--wYY2RIbTWxgOAp6vQBQ&layout=/sadbundle/%24csp%253Der3%24/11839137306054191879/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CN-q27vh1PQCFZUDfQod5wEM5Q&gqi=0--wYY2RIbTWxgOAp6vQBQ&layout=/sadbundle/%24csp%253Der3%24/11839137306054191879/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
content-length: 41185
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Dec 2021 17:48:04 GMT
cache-control: private

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/ Frame F705 11 KB
5 KB 26ms
25ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d853164105815c3ea423a95f095ee531f547ff1e12fba56a80be0f712c62929e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 07 Dec 2021 19:20:22 GMT
expires: Tue, 21 Dec 2021 19:20:22 GMT
content-type: text/html; charset=UTF-8
etag: 17731914101004188133
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4884
x-xss-protection: 0
age: 80861
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/ Frame 1D70 11 KB
5 KB 25ms
25ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d853164105815c3ea423a95f095ee531f547ff1e12fba56a80be0f712c62929e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 07 Dec 2021 19:20:22 GMT
expires: Tue, 21 Dec 2021 19:20:22 GMT
content-type: text/html; charset=UTF-8
etag: 17731914101004188133
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4884
x-xss-protection: 0
age: 80861
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 css2
fonts.googleapis.com/ Frame F705 4 KB
634 B 80ms
40ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Dec 2021 17:38:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 08 Dec 2021 17:48:03 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Dec 2021 17:48:03 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame F705 205 B
229 B 27ms
26ms Image
image/png 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 12:49:28 GMT
x-content-type-options: nosniff
age: 17915
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 08 Dec 2022 12:49:28 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame F705 604 B
628 B 27ms
27ms Image
image/png 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Dec 2021 18:06:12 GMT
x-content-type-options: nosniff
age: 85311
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 07 Dec 2022 18:06:12 GMT

GET
H2 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/elements/html/ Frame F705 19 KB
8 KB 127ms
50ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

860a2d1e52b3c209d9e566a7962296196eb7800255520c48f88ed898c19e5549

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:32:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 930
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 2041019696210882227
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:32:33 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/ Frame 1D70 19 KB
8 KB 88ms
25ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cd429ca4b699add93c19c2731a22a489a5a5d6d1d01445d337f8c89c8ca6eb2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:40:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 445
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7866
x-xss-protection: 0
server: cafe
etag: 5920091025124701355
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:40:38 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame 1D70 2 KB
1 KB 103ms
41ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 184
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:44:59 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame 1D70 15 KB
6 KB 90ms
29ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28277814cf8060f9fe40684129799beca6dc209f3b04c72ccde70b93c6c5c15b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 383
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6455
x-xss-protection: 0
server: cafe
etag: 3508882476506594800
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:41:40 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1D70 119 KB
37 KB 117ms
38ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 08 Dec 2021 17:48:03 GMT

GET
H2 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame 1D70 27 KB
11 KB 107ms
46ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

963c8078bf539ed77cedb3069b1c40cabd089543c09b429b7007fc06cbeac978

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Dec 2021 18:44:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11408
x-xss-protection: 0
server: cafe
etag: 810747636693205972
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Dec 2021 18:44:43 GMT

GET
H2 200 5918153753904517132
tpc.googlesyndication.com/simgad/ Frame 1D70 14 KB
15 KB 102ms
42ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5918153753904517132?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmCp8IfaAGTZFVzGR8TyPb0lPubxw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

72bb08ae4b593383918aa40dbf98fe8cc4d946dce9b2fdbf7bb6e58fe382f862

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 08:25:28 GMT
x-content-type-options: nosniff
age: 33755
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14519
x-xss-protection: 0
last-modified: Wed, 14 Nov 2018 14:45:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 08 Dec 2022 08:25:28 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame C4C4 3 KB
579 B 40ms
40ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Dec 2021 17:39:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 08 Dec 2021 17:48:03 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Dec 2021 17:48:03 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame C4C4 1 KB
880 B 96ms
49ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:44:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 194
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 853
x-xss-protection: 0
server: cafe
etag: 7170004918125193417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:44:49 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/ Frame C4C4 19 KB
8 KB 81ms
37ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cd429ca4b699add93c19c2731a22a489a5a5d6d1d01445d337f8c89c8ca6eb2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:40:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 445
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7866
x-xss-protection: 0
server: cafe
etag: 5920091025124701355
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:40:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame C4C4 2 KB
1 KB 80ms
36ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 184
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:44:59 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame C4C4 15 KB
6 KB 82ms
41ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28277814cf8060f9fe40684129799beca6dc209f3b04c72ccde70b93c6c5c15b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 383
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6455
x-xss-protection: 0
server: cafe
etag: 3508882476506594800
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:41:40 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C4C4 119 KB
37 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 08 Dec 2021 17:48:03 GMT

GET
H3 200 6d065ef8aad4e53a06604e1059b7b7b3.js Show response
www.gstatic.com/mysidia/ Frame C4C4 27 KB
11 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/6d065ef8aad4e53a06604e1059b7b7b3.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b138f0b28fe44581bebb03d0ff7046e4f8416deeb5d152ede640eaa3dc1c7872

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Dec 2021 19:06:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81673
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11408
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 07:52:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 07 Mar 2022 19:06:50 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BFFF 143 B
163 B 26ms
25ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 08 Dec 2021 16:58:32 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2971
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 redir.html Show response
p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame FDCA 247 B
961 B 154ms
45ms Document
text/html 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f3.1e100.net

Software

sffe /

Resource Hash

0bd46f36ba2ec7f825283c462563bdeab33d927d46b94b03cc8f6349ae589f45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-hy2kBmlOYSEss2SVj4ZjTw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 203
date: Wed, 08 Dec 2021 17:48:03 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Mon, 02 Dec 2019 20:15:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 redir.html Show response
p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 555F 247 B
960 B 121ms
35ms Document
text/html 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

e31aa7d2c0d11267d6e4513e11849566e572e355fc6d14982f9affa7093e87b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-f9ewNlEDeIr5XdLuwlyvog' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 202
date: Wed, 08 Dec 2021 17:48:03 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Mon, 02 Dec 2019 20:15:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BFFF
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
18 B

105ms
104ms

Document
text/html

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Dec 2021 17:48:04 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 08 Dec 2021 17:48:03 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 iframe.html Show response
p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame FDCA 4 KB
2 KB 76ms
38ms Document
text/html 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f3.1e100.net

Software

sffe /

Resource Hash

934a56c9bbf7d0a09dc29bb88ebe1734b36d77d41996fbb0653ea84eb5496b49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-1U9paJLPzoqBF8pUcHGyNg' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 1863
date: Wed, 08 Dec 2021 17:48:03 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Thu, 29 Apr 2021 21:38:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 iframe.html Show response
p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 555F 4 KB
2 KB 69ms
35ms Document
text/html 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

b5f71c8c69f6c82cdd6445f6b0d9ffb2d079c8be0d4db711628d734bed811222

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-1FS58Zz1iPy7xG_m-3kemQ' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 1862
date: Wed, 08 Dec 2021 17:48:04 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Thu, 29 Apr 2021 21:38:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js Show response
pagead2.googlesyndication.com/bg/ Frame CDEE 35 KB
13 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211206/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969b16dbf7df3d84d9f2b6498dbd14531a8de0cb889e0532a9d1fd3f1f3c46b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:06:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2489
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13349
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 17:06:35 GMT

GET
H3 200 lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js Show response
pagead2.googlesyndication.com/bg/ Frame A33D 35 KB
13 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969b16dbf7df3d84d9f2b6498dbd14531a8de0cb889e0532a9d1fd3f1f3c46b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:06:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2489
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13349
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 17:06:35 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F885 42 B
63 B 60ms
60ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CgZ4UOQI2PCk4EnQuUtvcDvgSPn-UdUVIqZA3-79Rkre1SMmJzBwtW-DxXzanKBuRbDGZNEPvTziOTmu-1TDHzm5dYqQLbXQ7vLxLp6YBuaNdS0aw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3332885161&adf=3836665116&pi=t.aa~a.3491345329~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=2&bdt=1198&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0&nras=2&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=pbV4puejKF&p=https%3A//beautyticks.com&dtd=20

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame F885 2 KB
1 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:44:59 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame F885 15 KB
6 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28277814cf8060f9fe40684129799beca6dc209f3b04c72ccde70b93c6c5c15b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6455
x-xss-protection: 0
server: cafe
etag: 3508882476506594800
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:41:40 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame F885 0
0 37ms
36ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSeb09CX-9Hm2ocmCyJkjf53A6CI0FQTKOWYf9X85RJplDuJ6ZgAi5E8waCZixBvZllk5mGALZbeLjI7tsnW457gYfalA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3332885161&adf=3836665116&pi=t.aa~a.3491345329~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=2&bdt=1198&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0&nras=2&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=pbV4puejKF&p=https%3A//beautyticks.com&dtd=20
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F885 119 KB
36 KB 532ms
493ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 08 Dec 2021 17:48:04 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E841 42 B
63 B 60ms
60ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CnX9JSyhgKAPWLAdF1JNZTCusPHwz3vkDZVAtViOU4t6hq6c8hSA4P4KGaWsiLRlNP73Bec3k2udKVFISJx_q65vFRkvzrp9nG4k_tL_ZRiZEhfuc

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3584321639&adf=3048362026&pi=t.aa~a.2659481085~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250&nras=5&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=2405&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=PSI4l760Ij&p=https%3A//beautyticks.com&dtd=77

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame E841 2 KB
1 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:44:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E841 119 KB
36 KB 470ms
435ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 08 Dec 2021 17:48:04 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame E841 15 KB
6 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28277814cf8060f9fe40684129799beca6dc209f3b04c72ccde70b93c6c5c15b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6455
x-xss-protection: 0
server: cafe
etag: 3508882476506594800
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:41:40 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 16AF 624 B
297 B 40ms
39ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYtKWdlwEwAQ&v=APEucNXDDLiajj84gi3dK92COjHiJvl_Bb8sHCGTKc7ztgLim0Tg3ajYl1zUaBVP8agJiApI3G4YHM9lv7kO0Xu6-mm3SZpLQ0pei1pmCvB6XDg2M_FlL-zePS8EbekLxhNqr2sP16D6DPL9-WYD5j-hT9E_AwFp2NCvMpx7iDIWySA1VyKYwMU

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3332885161&adf=3836665116&pi=t.aa~a.3491345329~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=2&bdt=1198&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0&nras=2&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=pbV4puejKF&p=https%3A//beautyticks.com&dtd=20

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F885 71 KB
29 KB 81ms
80ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A7YjhIb22AlIpIw86WUR5Y1mzZ5M7qxfkJB3x-2Ct3gIORW_Q8twCYjaApwiplh5-Obidids3YfPhjJiqNHXDX4qXLZZ7DoguFiQxjgGhXmTl5immMWuRU98sJbNzv7nTfb8Z6WNViRvszzoxuEBOVeG3a2w&dbm_d=AKAmf-BTwQ8APTE8rJD4IBeqb9mBCUSxBzNgRNgxezQn6sEAhZiO6FjeskpUKT97f8fb0MlVQAYiv3-fn0761MMp6wvrLbqtAFsFExUgIGq_9KsfAQpK6UeEkwpnnWCJc3R_527qh4_awHFIB1FA9M7vDe6jzQVjEg1WWQzWSTXOcxZdhd6dpHlB-UT4FqIKRnwGMf--i5bnH9RlY-du_1guYTfD4W5YN-aYZx9OjugVtr5lafZ-owuDr7pS03rcsxf8HtAIOMNxqNaIo4NAIX1s-0VKXZVcB4u0tH-TmoQn5WGtaNsAgkkqb309R2oT6iJLJpCyIQuePxNdTfUIq3orfMSQDvF3qLfgfz0Y1Mb6Xn0X1nfpxC4VxJu-_GtMr56U7fBRGlaShKcAKQornQ5RgTYVvgU03cxQjlO5crjettKRsDKY9TT0DkVdcgu9iEGTJv8IHs7OumUQ6mUME2Z0cVjT8j-9HSrrSuJ8Z7BKTWWmFiY48Ub7jTIXWjy0pGxZId0pfGM1eo1ZSAqKeG0gposkW4CJKzjlo1KsGXs4RTeQWgjiX6emWEgOil6ke3qL3w-N-YptN2ptDOAquQQFCulPcMFVQvI7UDZEq-h9qfrhF4a8-m56leRnGZ2nEJFgK8581mhx5tQWUCiS-woKCPC6qJXBu2wMpUYOyetE3xg-vyMnaPvUBCXPwT62uM0TrOnsqALjbTwVTj-hixSRHbMnldNvHjqgpnfUj1T-0T8B1Cxqby7PLXGfbSOr94aqboI3HexenmaPN-lTnF2DKOxRrv74dy6iTu0zepZbuyY1AQ_f8l5HzTr6D7CKKu7bk6AlLJQUfG59K1eWSppQQkJ99UBPT1t7dBPnCppoyjmVs0e0hIkhI7aMUWZlwq3FtVP8SXinGvO_vzzqmv6rmtmM-89dyjguGS0MOaJuAFvRSHv01xxQXSd5iTuESxsiXvwgRv5qHS82ojO0vsW2ZHrCzSjtbPRFp5Nr_Ta8M5E4RSa1rMnRz-iGKTJq5IHTz62w-8Ibyd554JaY_ueqQL75CF7p0QAkGA5aYdQ8VcE9twzugi9Dx-KEdn5tGRg8FaIWBGPggL0o52x_84_wIPdrCirEzNcNmmIu3LOQ0XoLcvO9fXNSL_2ZzND7qO2nLmS6kq4JIzLZsf9sFfLZLyBUx8BarMw_pFoOQx0qLt-NEQLncEeFrPOe4sqiMcHaCRPJ03-jFPDhLvKdH65WUD3RDgNbewbsGFDbjcrgvQz6PFA7k993pX8XNa5P8OqR4ruV6SKq4zjX_Fhr8GhqOqH50y_GTB-JNu41n6ntqYZYFhguLXnoIUdCj2bCdwOQP60AKIeaV0ik_g6jjq9PhiKP573Us1AtM0C8hmMPXn4u5bcv3WTfUUf87lIaPory-wQLd51eRmJ2d-zE64nQOjMwl4fRnngPdOCl3l0nUycMTyH3gkW_-OfjKduWxf0mrgh-g0rEmesg2a7njVDiC2Fbk0mBBf1Qen44S8Ae0-H1YwR2GoDKaBgYHLSchi2yNSABHaaevNbOMuo5zVyAZ035Os26T0z-0NnNKlqhC0AWYzAoYl8gjsmGTK5QqxsuZ7Z0_vwGq8bGpOzd6El3sRfiKSGBB_B87uIkiyYiWXO8VoylQ11HOjaxmVMqxf-tQBBMwHJ0-sJUCWKcO13J5Dqw9gDHEyq57E1tdoddws8HxC-Xl_Y6xE64YN9fAv8WSaFD_fEa1vVSW-47q5m0RvqKjF-W8zmCEKx8TY_VgUg70DTotC9NJ4T3yk9FPuusqaemEQtC9Odz6u79dbDYb7JoIc7ogIm_2w6AF0GnFz-flxscRVlvxt85QRCHXtbQIu26imkj51Hf19Q9jSJncRYNDbwnJtXUHUr_Bu--kF57bL4CZml7l6rfHu8EnpU2_uY0OT6jqgyDPAEoKE-87fpCqyJAcdJYPZXjJ1HrrA7QByWrld4KU-jWqAgDlaXhZ3vqdY_W7HudP3p700N08uy7N4Ks3v0e3EyZDsbcG0OPDnFsxSdulLL6Rop_9gbZDRwlPFsZ5Rg0HrLqRN0fXpvDlJw67d1MSdBOVR6iUz7Sn1bDFGk27kryehCKNCSFEGX6Mpsv54OcMEVxRJsuHzmZpAiV6zCM6aYfTTzPfoJM_EnHfo8ww0Nx3AGi46gztCKx-c5TUANE8Jv8EbEz6wpax9POdqKewxICoySf8P-WZyfYRpQqrLyxqclqVkmuZixRaurZ-P4o8-hSHglRKJZXBVbieVxZ8b4qIll2rd1APFL6HXVBnX0HpJKwsmMG0Nsew5bTWId10N2HVMXlqTOCRF0PNELlT6rhHFb64k1uCNFgK3H4kr3XCnb9hXOHm7vCNdUMFBnqx-A99xcb7eItYKM5dMTb8T2cmD5y4QxvzYrtcySte8yLYQKTe35tnKUDswSHQg9Xx9czYImx0Yq446l5qF9VvrjCjxBAyAohPABLRyUGQdlC_cTiH_TfTW9NguKLdHHEF7BpYJ52SDZfG9TOjL3Jew9HdLqqKtHixxFBmmDdmRmjWo-BgcDNPQMgDrrgDmAfD5M2s2_Bqbgqj-g9QrLBFrzBolwUfEQuvN9riTBlV3Iwkhd2F9m4NE7lozyLkxL2hEm8S-fBHLFsXcVr2b3YPK3Ps-U4DhPFJEmmQoAfniGBuRnGCPYjdZQULtJq-RrWINV_LXqdocbHBiojwiK0RWrbCseZiK0tmOqrLIA40-mR5pW1hgwY0Vlmv1ijRuwm8cE71L-OXhgyfx0nMNm0upUJmEiOmGepEO2d6G5S6TEjfRY5GHWgl-9j6sDxC-1_NgEMdx4kGXyQPqqWH2gf998zT7PHlsQQHUPFTE-EsWOMASbmiFyurCa8RXnwBBOVsp5AP4vRRGT6K6eyLQXV2L-XHXe-hG5RrjV89z57WmT6PrkK_KTh0washHkXc9p4xySGMOyC6DUpZnsoRJ69_P6q70De8phPgrSBimMbBoDfW3Q02CwQ2rUAjCGGHpZ0gQCJ15TDn3y2lZEoDQ&cid=CAASEuRo3FDVX6HtgQbrJ0XHqb6Cow&rfl=1%2Chttps%253A%252F%252Fbeautyticks.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cde426d62acafe0e85b94e93258d95e690c487641a6b3213c0a7603d68a1b4fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3332885161&adf=3836665116&pi=t.aa~a.3491345329~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=2&bdt=1198&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0&nras=2&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=pbV4puejKF&p=https%3A//beautyticks.com&dtd=20
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30174
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 45B9 624 B
297 B 40ms
40ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYtKWdlwEwAQ&v=APEucNU9-OVbyFDfxIghfxvaI3nb-kM9f-BvhGTZ6leHoRyYnl-Ysv-vt6_vp6EIWdgVuoM557O2ZjisX1Ces50QgGdTLI_Jn9SmkQ5dufJ5JyMj9YucSaMQayS1mh5bTwzOPG_rSkRqPFB4ypbHkxzG0KKvGjfs3GDKC3GLUInAdQinJwf4-2E

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3584321639&adf=3048362026&pi=t.aa~a.2659481085~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250&nras=5&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=2405&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=PSI4l760Ij&p=https%3A//beautyticks.com&dtd=77

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E841 71 KB
30 KB 83ms
82ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AznVde2R73ZWdRjkCAbibQU5WV2pf9GNoa2jsz0b9Kgbbb9NClCorI-bSASPUbcX2p3iSiJ4GSBHZuI2ZVwk8NGSob5D2GB0KnTDDqedUEVkTOj--qmHXqi4U4ZNO_eRHradmYKaIRoSlgQdsU21ySuFjHZA&dbm_d=AKAmf-A9SsI-Gz9ixRa6pt_REl9Z0xvMhtJT51o_gpKmxV8nBF-wSkzmlc-a-4m2nYiSKe8labSoIy4IEOXzKtGmfCa1VVZ45TtmW1cYanWHUcBy65OcoTMuoOaIR-V2fjGqOOAcGi5JwLRtjnpgwBHEtd01ZQOxBjIxyQyQss3_Dy_LZHlwlJwatxM1dcds5ZcM8MwXTNF__wUAnmfq_xGhs8uY3JI7cn-Ng56kgsw0jPKF0jJ8MCcSGQx7H-mtaFNLi5nBgv6VA7zfrZdVOZxK_NDOkiofDokoBwMXg17AoL_rlK9L1ATsGKg155t9Q560w_bHRT2L9_nXaSzdMfzOGjSvhVz58aJgLedxCBLWEXzULciWHT-waOPyIPl0_8cEDcZAi0jDrxi78wuQHlQ-JbecPvZ3uUa5YkACH--LKzYleclQzpop_rC7MPdu7erv6Iy_zel8x25uHdvbByAQAVOtdO-8BKZIVTeLfbGFeZO4XbGDX4X5pfInYSDkwfWhNRz2RQSuNLnnl57Ng3XLBpmrXpD0atiJKJzMpkk3aZzljP7GGpNqiBTkpiFWQ3JYv4AlBTqIQurlnQ7btbFR0w_MmLlj_nY4jsdIJu3BwPOEXy9estpC1jCsiGlS7zSfjWdCd3Msa5h5fUUK_L-xn52hLdpmaZFSZcFaVjZu6kRpRAhVQl57LF3b8asd98QRXaKEHdpMHrt2dVsxoV3KLeiRbxZ5QbVDXLNFiJ95WZaF5L0Dg2BUKwNqHE8Pl7JllcnbqP2wwOCZDXK-Q41I7QLqBlW22knzlXChlPAqpyEKxMlclCeSl2-Uh03L5BPKQ04YGw3Or8cQuVF2bmTJrZmDxA3qOOuBCezZyDnFlPJ6a03tRKJ0oK7AxxYicKrbQO0DuPnjt6qh16w87lsvfYjBVwNDXMYcBborrxYgOPcP2WbTXeC0VRJ7ICW7-nozsfBvORquRsXQUhLIbhZUm-6pn8Rx4qllLn_OIeE4UTCmtDfFT7E2mi55AXgfWffnZZ7R7tIkK0bo-J-Mhl1mqCjLmXlLVEQ1n0pg7WAyO_cvHtKZPguhj9MzqKotBLGq9Pt-eQqt1QKVWv59QRkICyYGcgEpsZINSFA7pXtKxHpD5eqrsKGnXJYlbA9ewMv6Vb1L8y2QYhZUrkwHdCJzPNvUVY9HKoUi7IdArxlSc_JrkSv74FsNoco08uTvo0n79IViWofAuWUjD2TikL2ABdk784dOa4wcyqvPBMrMvTS7pTsmpCUiRGJyrINqCezfuaQmUvaz25eftEQFrYevnsdhAp0MgIgUP4_-xEH4ieN6xtQZT1xkIaw0ATUomMA-L1V8JOJ2NgpNCYug9hDfKRWXKjNZXQ2IwVjE_HgMRPtpCYpg2Qit2_42NyNrTBnJsePCVk_sqYoobHx2d2uQ8cxXA3oGWFcQw-MHJBeLQOXfQwhfVFTIhAe_PZAHBhF9MMKPWCxAwrFnsI4JMY-YEwxrcgJym4heE-jHiM7HtngOIbt9wZxAYO5MfSP8io0VEVKCDxsuKqZw-dKW-69SOF_D9U8QXer0G1qYSE-OPkFp1R5NaXNQekhkW75qD2cTkk02wZbfu3m6twI96FMiTd3GuqposRNTQsS1HV7gvw9gRe84QgIzKornEbJ2QztzBduMyGZRzpz8V9fs_SwXI2A9_n_FAYlYaNoxQd2Iv-60728qTm-OyJRMtRA8mEVtv4VPbEf_ActgcBghwcuTMWeTuSdBzHrN5u6uGEIRfRVbExXGrrCu3u0h4soX7gBhVS9fLwGo_lGiWutoh-RCaV2papMA49rDCOR_LZ4Lba1_R6_KRPeXYF5TxefrtzUdBItmwVdoeJcmVHN4yjxsE-npW8LDjOfVTB4c0mO2LDU3W3YastZniuiXUjs8HZZhwUZdaccUuoETRGYMBhb67Rqk6YJZZJ9j-GITrUa3kCxDvwvzXZ7U8F91TP0HpocxNNP4vbjGjlefu5jiF9REcm52cPC5gmvnleqho-vL40OdEEYTYMSjtq8D9pilM-mR6hW_MG_OkGh-9tkoW4kj2UAZJ3aRxacbt3fY87hDomYV8ds-pKgYs-JtaiaIG9mxTo2YpzbMILDBOu1JhJffwEJwRC1tZXqhaU848HKB_r_Zb-TX_gSVju7cmX2d5TtgFY6wmZvDSekyFEXFX5_pIlZpmC11nObPVCuEUkNWCsLUTT5I0fnMVfz2StZcp1vZ88wxgXMUw4I3O6VrRnfJndAVTOSBbWMMpLBwCKj-HvnjN9hsMu_bP4DugPWXgBO6B2uLlFpoDajM_493x7aFv9yPvgNAxbs_O1KyZ6Ze9ATGzNtSWKjxLFU5JTD6uwSqvW07kcDg4zRS0T66qS1xKMh0TK1X5hXmLzegzxo2sDBnmm0-pHGFKMDUtHPNsNbRe-ecLB9WRnC_4M1Ox2a2iJdi1rxPNzfMVZdkAuAuiMBlEmRIN4TuGq8N4g3OE3Ib7hYwQBA6Zk7SXCwE7qIGn206F3WANJtp-HH5VbjKmZriLVH30_oCSzKrYL8oOXa9EuChUm4d8kPFSK3WdF1mh2e7jY0B640kedKV9OWJhQDeTguBa-Y0FlM51YVctyRae24jhKDhxaKAsKjIUPWrvtEFbsbumeoGr6Ugj-oo5iTQKkTJCua_iQuYsIz7vJigjeMdTHdCIuHHKypTur3mHj0LxdUoZcSdTygFGnOuWMEHw8vl5FWIn0VJLUKauYayYhl6rKDT04D_irEtRiDpRM2nvWnH2ZTkD3hJM0xHB3MAN6jhe1fevOL8bBLGo4AnHDVFuFi65vzXx8vTLkeDfmtdNEJEJ-TVwqvpQUwE2Jt-dFaFyjWmDCXDEQMjquMiVtpA-yUWGASCjSqzBX7DseLe8r1XwSu3R1MAmk_cH2QhltUJ1B91BADYUm3RVA5nlTXeJqMMe7G9U3jZ_oX1EZf_RNmULvfKvzjBx3YXXTQwnYwRYvSskLsjjQeRHjvCwmfvZZ6urokBVKAldrhv-EK_RjvON0Ic_mnjFXIAPzJBSGsX2RY&cid=CAASEuRo3tilCIe_CdTxlAgL4l1Saw&rfl=1%2Chttps%253A%252F%252Fbeautyticks.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57c4a3c357741e9cbe4f96cb3756903d6b49615d620ccffbcf474b0add8966d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3584321639&adf=3048362026&pi=t.aa~a.2659481085~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250&nras=5&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=2405&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=PSI4l760Ij&p=https%3A//beautyticks.com&dtd=77
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30306
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 16AF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKDFPUlB4BwJcNZ_8g5kSPg&google_cver=1

43 B
1012 B

94ms
45ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKDFPUlB4BwJcNZ_8g5kSPg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYtKWdlwEwAQ&v=APEucNXDDLiajj84gi3dK92COjHiJvl_Bb8sHCGTKc7ztgLim0Tg3ajYl1zUaBVP8agJiApI3G4YHM9lv7kO0Xu6-mm3SZpLQ0pei1pmCvB6XDg2M_FlL-zePS8EbekLxhNqr2sP16D6DPL9-WYD5j-hT9E_AwFp2NCvMpx7iDIWySA1VyKYwMU
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 08 Dec 2021 17:48:04 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 08 Dec 2021 17:48:04 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKDFPUlB4BwJcNZ_8g5kSPg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 16AF
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YbDv1K6GtmvEeL-N6tKSUQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMlq2tUU52ike68RV9VVM-g&google_cver=1

43 B
892 B

56ms
55ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMlq2tUU52ike68RV9VVM-g&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYtKWdlwEwAQ&v=APEucNXDDLiajj84gi3dK92COjHiJvl_Bb8sHCGTKc7ztgLim0Tg3ajYl1zUaBVP8agJiApI3G4YHM9lv7kO0Xu6-mm3SZpLQ0pei1pmCvB6XDg2M_FlL-zePS8EbekLxhNqr2sP16D6DPL9-WYD5j-hT9E_AwFp2NCvMpx7iDIWySA1VyKYwMU
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 08 Dec 2021 17:48:04 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 08 Dec 2021 17:48:04 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMlq2tUU52ike68RV9VVM-g&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 16AF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEEeytP3tJOpZ-AECUalxGos&google_cver=1

43 B
1002 B

43ms
35ms

Image
image/gif

185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEEeytP3tJOpZ-AECUalxGos&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYtKWdlwEwAQ&v=APEucNXDDLiajj84gi3dK92COjHiJvl_Bb8sHCGTKc7ztgLim0Tg3ajYl1zUaBVP8agJiApI3G4YHM9lv7kO0Xu6-mm3SZpLQ0pei1pmCvB6XDg2M_FlL-zePS8EbekLxhNqr2sP16D6DPL9-WYD5j-hT9E_AwFp2NCvMpx7iDIWySA1VyKYwMU

Protocol

HTTP/1.1

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 08 Dec 2021 17:48:04 GMT
X-Proxy-Origin: 82.102.26.68; 82.102.26.68; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9168f963-c8e7-48a4-b9f0-7f0c99985776
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEEeytP3tJOpZ-AECUalxGos&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 16AF
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTY4NTE2ODM1OTMyNzY0NDk5NQ%3D%3D

170 B
188 B

38ms
38ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTY4NTE2ODM1OTMyNzY0NDk5NQ%3D%3D

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 08 Dec 2021 17:48:04 GMT
X-Proxy-Origin: 82.102.26.68; 82.102.26.68; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 6ca2b622-aad6-46ab-b94b-fe30704360f9
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTY4NTE2ODM1OTMyNzY0NDk5NQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 45B9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKDFPUlB4BwJcNZ_8g5kSPg&google_cver=1

43 B
1012 B

90ms
40ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKDFPUlB4BwJcNZ_8g5kSPg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYtKWdlwEwAQ&v=APEucNU9-OVbyFDfxIghfxvaI3nb-kM9f-BvhGTZ6leHoRyYnl-Ysv-vt6_vp6EIWdgVuoM557O2ZjisX1Ces50QgGdTLI_Jn9SmkQ5dufJ5JyMj9YucSaMQayS1mh5bTwzOPG_rSkRqPFB4ypbHkxzG0KKvGjfs3GDKC3GLUInAdQinJwf4-2E
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 08 Dec 2021 17:48:04 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 08 Dec 2021 17:48:04 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKDFPUlB4BwJcNZ_8g5kSPg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 45B9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YbDv1K6GtmvEeL-N6tKSUQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMlq2tUU52ike68RV9VVM-g&google_cver=1

43 B
892 B

38ms
37ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMlq2tUU52ike68RV9VVM-g&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYtKWdlwEwAQ&v=APEucNU9-OVbyFDfxIghfxvaI3nb-kM9f-BvhGTZ6leHoRyYnl-Ysv-vt6_vp6EIWdgVuoM557O2ZjisX1Ces50QgGdTLI_Jn9SmkQ5dufJ5JyMj9YucSaMQayS1mh5bTwzOPG_rSkRqPFB4ypbHkxzG0KKvGjfs3GDKC3GLUInAdQinJwf4-2E
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 08 Dec 2021 17:48:04 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 08 Dec 2021 17:48:04 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMlq2tUU52ike68RV9VVM-g&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 45B9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEEeytP3tJOpZ-AECUalxGos&google_cver=1

43 B
1002 B

81ms
73ms

Image
image/gif

185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEEeytP3tJOpZ-AECUalxGos&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYtKWdlwEwAQ&v=APEucNU9-OVbyFDfxIghfxvaI3nb-kM9f-BvhGTZ6leHoRyYnl-Ysv-vt6_vp6EIWdgVuoM557O2ZjisX1Ces50QgGdTLI_Jn9SmkQ5dufJ5JyMj9YucSaMQayS1mh5bTwzOPG_rSkRqPFB4ypbHkxzG0KKvGjfs3GDKC3GLUInAdQinJwf4-2E

Protocol

HTTP/1.1

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 08 Dec 2021 17:48:04 GMT
X-Proxy-Origin: 82.102.26.68; 82.102.26.68; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 2223ef5f-9964-42e9-ba9f-1e04b47f3237
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEEeytP3tJOpZ-AECUalxGos&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 45B9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTY4NTE2ODM1OTMyNzY0NDk5NQ%3D%3D

170 B
188 B

43ms
42ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTY4NTE2ODM1OTMyNzY0NDk5NQ%3D%3D

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 08 Dec 2021 17:48:04 GMT
X-Proxy-Origin: 82.102.26.68; 82.102.26.68; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 75975e95-9bcf-4f03-b21f-bd2babd38743
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTY4NTE2ODM1OTMyNzY0NDk5NQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame F885 106 KB
38 KB 95ms
27ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 13:10:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16632
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 09 Dec 2021 13:10:52 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211206/r20110914/elements/html/ Frame F885 8 KB
3 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211206/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A7YjhIb22AlIpIw86WUR5Y1mzZ5M7qxfkJB3x-2Ct3gIORW_Q8twCYjaApwiplh5-Obidids3YfPhjJiqNHXDX4qXLZZ7DoguFiQxjgGhXmTl5immMWuRU98sJbNzv7nTfb8Z6WNViRvszzoxuEBOVeG3a2w&dbm_d=AKAmf-BTwQ8APTE8rJD4IBeqb9mBCUSxBzNgRNgxezQn6sEAhZiO6FjeskpUKT97f8fb0MlVQAYiv3-fn0761MMp6wvrLbqtAFsFExUgIGq_9KsfAQpK6UeEkwpnnWCJc3R_527qh4_awHFIB1FA9M7vDe6jzQVjEg1WWQzWSTXOcxZdhd6dpHlB-UT4FqIKRnwGMf--i5bnH9RlY-du_1guYTfD4W5YN-aYZx9OjugVtr5lafZ-owuDr7pS03rcsxf8HtAIOMNxqNaIo4NAIX1s-0VKXZVcB4u0tH-TmoQn5WGtaNsAgkkqb309R2oT6iJLJpCyIQuePxNdTfUIq3orfMSQDvF3qLfgfz0Y1Mb6Xn0X1nfpxC4VxJu-_GtMr56U7fBRGlaShKcAKQornQ5RgTYVvgU03cxQjlO5crjettKRsDKY9TT0DkVdcgu9iEGTJv8IHs7OumUQ6mUME2Z0cVjT8j-9HSrrSuJ8Z7BKTWWmFiY48Ub7jTIXWjy0pGxZId0pfGM1eo1ZSAqKeG0gposkW4CJKzjlo1KsGXs4RTeQWgjiX6emWEgOil6ke3qL3w-N-YptN2ptDOAquQQFCulPcMFVQvI7UDZEq-h9qfrhF4a8-m56leRnGZ2nEJFgK8581mhx5tQWUCiS-woKCPC6qJXBu2wMpUYOyetE3xg-vyMnaPvUBCXPwT62uM0TrOnsqALjbTwVTj-hixSRHbMnldNvHjqgpnfUj1T-0T8B1Cxqby7PLXGfbSOr94aqboI3HexenmaPN-lTnF2DKOxRrv74dy6iTu0zepZbuyY1AQ_f8l5HzTr6D7CKKu7bk6AlLJQUfG59K1eWSppQQkJ99UBPT1t7dBPnCppoyjmVs0e0hIkhI7aMUWZlwq3FtVP8SXinGvO_vzzqmv6rmtmM-89dyjguGS0MOaJuAFvRSHv01xxQXSd5iTuESxsiXvwgRv5qHS82ojO0vsW2ZHrCzSjtbPRFp5Nr_Ta8M5E4RSa1rMnRz-iGKTJq5IHTz62w-8Ibyd554JaY_ueqQL75CF7p0QAkGA5aYdQ8VcE9twzugi9Dx-KEdn5tGRg8FaIWBGPggL0o52x_84_wIPdrCirEzNcNmmIu3LOQ0XoLcvO9fXNSL_2ZzND7qO2nLmS6kq4JIzLZsf9sFfLZLyBUx8BarMw_pFoOQx0qLt-NEQLncEeFrPOe4sqiMcHaCRPJ03-jFPDhLvKdH65WUD3RDgNbewbsGFDbjcrgvQz6PFA7k993pX8XNa5P8OqR4ruV6SKq4zjX_Fhr8GhqOqH50y_GTB-JNu41n6ntqYZYFhguLXnoIUdCj2bCdwOQP60AKIeaV0ik_g6jjq9PhiKP573Us1AtM0C8hmMPXn4u5bcv3WTfUUf87lIaPory-wQLd51eRmJ2d-zE64nQOjMwl4fRnngPdOCl3l0nUycMTyH3gkW_-OfjKduWxf0mrgh-g0rEmesg2a7njVDiC2Fbk0mBBf1Qen44S8Ae0-H1YwR2GoDKaBgYHLSchi2yNSABHaaevNbOMuo5zVyAZ035Os26T0z-0NnNKlqhC0AWYzAoYl8gjsmGTK5QqxsuZ7Z0_vwGq8bGpOzd6El3sRfiKSGBB_B87uIkiyYiWXO8VoylQ11HOjaxmVMqxf-tQBBMwHJ0-sJUCWKcO13J5Dqw9gDHEyq57E1tdoddws8HxC-Xl_Y6xE64YN9fAv8WSaFD_fEa1vVSW-47q5m0RvqKjF-W8zmCEKx8TY_VgUg70DTotC9NJ4T3yk9FPuusqaemEQtC9Odz6u79dbDYb7JoIc7ogIm_2w6AF0GnFz-flxscRVlvxt85QRCHXtbQIu26imkj51Hf19Q9jSJncRYNDbwnJtXUHUr_Bu--kF57bL4CZml7l6rfHu8EnpU2_uY0OT6jqgyDPAEoKE-87fpCqyJAcdJYPZXjJ1HrrA7QByWrld4KU-jWqAgDlaXhZ3vqdY_W7HudP3p700N08uy7N4Ks3v0e3EyZDsbcG0OPDnFsxSdulLL6Rop_9gbZDRwlPFsZ5Rg0HrLqRN0fXpvDlJw67d1MSdBOVR6iUz7Sn1bDFGk27kryehCKNCSFEGX6Mpsv54OcMEVxRJsuHzmZpAiV6zCM6aYfTTzPfoJM_EnHfo8ww0Nx3AGi46gztCKx-c5TUANE8Jv8EbEz6wpax9POdqKewxICoySf8P-WZyfYRpQqrLyxqclqVkmuZixRaurZ-P4o8-hSHglRKJZXBVbieVxZ8b4qIll2rd1APFL6HXVBnX0HpJKwsmMG0Nsew5bTWId10N2HVMXlqTOCRF0PNELlT6rhHFb64k1uCNFgK3H4kr3XCnb9hXOHm7vCNdUMFBnqx-A99xcb7eItYKM5dMTb8T2cmD5y4QxvzYrtcySte8yLYQKTe35tnKUDswSHQg9Xx9czYImx0Yq446l5qF9VvrjCjxBAyAohPABLRyUGQdlC_cTiH_TfTW9NguKLdHHEF7BpYJ52SDZfG9TOjL3Jew9HdLqqKtHixxFBmmDdmRmjWo-BgcDNPQMgDrrgDmAfD5M2s2_Bqbgqj-g9QrLBFrzBolwUfEQuvN9riTBlV3Iwkhd2F9m4NE7lozyLkxL2hEm8S-fBHLFsXcVr2b3YPK3Ps-U4DhPFJEmmQoAfniGBuRnGCPYjdZQULtJq-RrWINV_LXqdocbHBiojwiK0RWrbCseZiK0tmOqrLIA40-mR5pW1hgwY0Vlmv1ijRuwm8cE71L-OXhgyfx0nMNm0upUJmEiOmGepEO2d6G5S6TEjfRY5GHWgl-9j6sDxC-1_NgEMdx4kGXyQPqqWH2gf998zT7PHlsQQHUPFTE-EsWOMASbmiFyurCa8RXnwBBOVsp5AP4vRRGT6K6eyLQXV2L-XHXe-hG5RrjV89z57WmT6PrkK_KTh0washHkXc9p4xySGMOyC6DUpZnsoRJ69_P6q70De8phPgrSBimMbBoDfW3Q02CwQ2rUAjCGGHpZ0gQCJ15TDn3y2lZEoDQ&cid=CAASEuRo3FDVX6HtgQbrJ0XHqb6Cow&rfl=1%2Chttps%253A%252F%252Fbeautyticks.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:43:04 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211206/r20110914/ Frame F885 24 KB
9 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211206/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2da3cec06fc8ccae40077ed49d5eb86f550a110d914ee611611ba688f0fd610c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9505
x-xss-protection: 0
server: cafe
etag: 2191309775366055064
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:47:30 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame E841 106 KB
37 KB 108ms
50ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 13:10:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16632
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 09 Dec 2021 13:10:52 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211206/r20110914/elements/html/ Frame E841 8 KB
3 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211206/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AznVde2R73ZWdRjkCAbibQU5WV2pf9GNoa2jsz0b9Kgbbb9NClCorI-bSASPUbcX2p3iSiJ4GSBHZuI2ZVwk8NGSob5D2GB0KnTDDqedUEVkTOj--qmHXqi4U4ZNO_eRHradmYKaIRoSlgQdsU21ySuFjHZA&dbm_d=AKAmf-A9SsI-Gz9ixRa6pt_REl9Z0xvMhtJT51o_gpKmxV8nBF-wSkzmlc-a-4m2nYiSKe8labSoIy4IEOXzKtGmfCa1VVZ45TtmW1cYanWHUcBy65OcoTMuoOaIR-V2fjGqOOAcGi5JwLRtjnpgwBHEtd01ZQOxBjIxyQyQss3_Dy_LZHlwlJwatxM1dcds5ZcM8MwXTNF__wUAnmfq_xGhs8uY3JI7cn-Ng56kgsw0jPKF0jJ8MCcSGQx7H-mtaFNLi5nBgv6VA7zfrZdVOZxK_NDOkiofDokoBwMXg17AoL_rlK9L1ATsGKg155t9Q560w_bHRT2L9_nXaSzdMfzOGjSvhVz58aJgLedxCBLWEXzULciWHT-waOPyIPl0_8cEDcZAi0jDrxi78wuQHlQ-JbecPvZ3uUa5YkACH--LKzYleclQzpop_rC7MPdu7erv6Iy_zel8x25uHdvbByAQAVOtdO-8BKZIVTeLfbGFeZO4XbGDX4X5pfInYSDkwfWhNRz2RQSuNLnnl57Ng3XLBpmrXpD0atiJKJzMpkk3aZzljP7GGpNqiBTkpiFWQ3JYv4AlBTqIQurlnQ7btbFR0w_MmLlj_nY4jsdIJu3BwPOEXy9estpC1jCsiGlS7zSfjWdCd3Msa5h5fUUK_L-xn52hLdpmaZFSZcFaVjZu6kRpRAhVQl57LF3b8asd98QRXaKEHdpMHrt2dVsxoV3KLeiRbxZ5QbVDXLNFiJ95WZaF5L0Dg2BUKwNqHE8Pl7JllcnbqP2wwOCZDXK-Q41I7QLqBlW22knzlXChlPAqpyEKxMlclCeSl2-Uh03L5BPKQ04YGw3Or8cQuVF2bmTJrZmDxA3qOOuBCezZyDnFlPJ6a03tRKJ0oK7AxxYicKrbQO0DuPnjt6qh16w87lsvfYjBVwNDXMYcBborrxYgOPcP2WbTXeC0VRJ7ICW7-nozsfBvORquRsXQUhLIbhZUm-6pn8Rx4qllLn_OIeE4UTCmtDfFT7E2mi55AXgfWffnZZ7R7tIkK0bo-J-Mhl1mqCjLmXlLVEQ1n0pg7WAyO_cvHtKZPguhj9MzqKotBLGq9Pt-eQqt1QKVWv59QRkICyYGcgEpsZINSFA7pXtKxHpD5eqrsKGnXJYlbA9ewMv6Vb1L8y2QYhZUrkwHdCJzPNvUVY9HKoUi7IdArxlSc_JrkSv74FsNoco08uTvo0n79IViWofAuWUjD2TikL2ABdk784dOa4wcyqvPBMrMvTS7pTsmpCUiRGJyrINqCezfuaQmUvaz25eftEQFrYevnsdhAp0MgIgUP4_-xEH4ieN6xtQZT1xkIaw0ATUomMA-L1V8JOJ2NgpNCYug9hDfKRWXKjNZXQ2IwVjE_HgMRPtpCYpg2Qit2_42NyNrTBnJsePCVk_sqYoobHx2d2uQ8cxXA3oGWFcQw-MHJBeLQOXfQwhfVFTIhAe_PZAHBhF9MMKPWCxAwrFnsI4JMY-YEwxrcgJym4heE-jHiM7HtngOIbt9wZxAYO5MfSP8io0VEVKCDxsuKqZw-dKW-69SOF_D9U8QXer0G1qYSE-OPkFp1R5NaXNQekhkW75qD2cTkk02wZbfu3m6twI96FMiTd3GuqposRNTQsS1HV7gvw9gRe84QgIzKornEbJ2QztzBduMyGZRzpz8V9fs_SwXI2A9_n_FAYlYaNoxQd2Iv-60728qTm-OyJRMtRA8mEVtv4VPbEf_ActgcBghwcuTMWeTuSdBzHrN5u6uGEIRfRVbExXGrrCu3u0h4soX7gBhVS9fLwGo_lGiWutoh-RCaV2papMA49rDCOR_LZ4Lba1_R6_KRPeXYF5TxefrtzUdBItmwVdoeJcmVHN4yjxsE-npW8LDjOfVTB4c0mO2LDU3W3YastZniuiXUjs8HZZhwUZdaccUuoETRGYMBhb67Rqk6YJZZJ9j-GITrUa3kCxDvwvzXZ7U8F91TP0HpocxNNP4vbjGjlefu5jiF9REcm52cPC5gmvnleqho-vL40OdEEYTYMSjtq8D9pilM-mR6hW_MG_OkGh-9tkoW4kj2UAZJ3aRxacbt3fY87hDomYV8ds-pKgYs-JtaiaIG9mxTo2YpzbMILDBOu1JhJffwEJwRC1tZXqhaU848HKB_r_Zb-TX_gSVju7cmX2d5TtgFY6wmZvDSekyFEXFX5_pIlZpmC11nObPVCuEUkNWCsLUTT5I0fnMVfz2StZcp1vZ88wxgXMUw4I3O6VrRnfJndAVTOSBbWMMpLBwCKj-HvnjN9hsMu_bP4DugPWXgBO6B2uLlFpoDajM_493x7aFv9yPvgNAxbs_O1KyZ6Ze9ATGzNtSWKjxLFU5JTD6uwSqvW07kcDg4zRS0T66qS1xKMh0TK1X5hXmLzegzxo2sDBnmm0-pHGFKMDUtHPNsNbRe-ecLB9WRnC_4M1Ox2a2iJdi1rxPNzfMVZdkAuAuiMBlEmRIN4TuGq8N4g3OE3Ib7hYwQBA6Zk7SXCwE7qIGn206F3WANJtp-HH5VbjKmZriLVH30_oCSzKrYL8oOXa9EuChUm4d8kPFSK3WdF1mh2e7jY0B640kedKV9OWJhQDeTguBa-Y0FlM51YVctyRae24jhKDhxaKAsKjIUPWrvtEFbsbumeoGr6Ugj-oo5iTQKkTJCua_iQuYsIz7vJigjeMdTHdCIuHHKypTur3mHj0LxdUoZcSdTygFGnOuWMEHw8vl5FWIn0VJLUKauYayYhl6rKDT04D_irEtRiDpRM2nvWnH2ZTkD3hJM0xHB3MAN6jhe1fevOL8bBLGo4AnHDVFuFi65vzXx8vTLkeDfmtdNEJEJ-TVwqvpQUwE2Jt-dFaFyjWmDCXDEQMjquMiVtpA-yUWGASCjSqzBX7DseLe8r1XwSu3R1MAmk_cH2QhltUJ1B91BADYUm3RVA5nlTXeJqMMe7G9U3jZ_oX1EZf_RNmULvfKvzjBx3YXXTQwnYwRYvSskLsjjQeRHjvCwmfvZZ6urokBVKAldrhv-EK_RjvON0Ic_mnjFXIAPzJBSGsX2RY&cid=CAASEuRo3tilCIe_CdTxlAgL4l1Saw&rfl=1%2Chttps%253A%252F%252Fbeautyticks.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:43:04 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211206/r20110914/ Frame E841 24 KB
9 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211206/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2da3cec06fc8ccae40077ed49d5eb86f550a110d914ee611611ba688f0fd610c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9505
x-xss-protection: 0
server: cafe
etag: 2191309775366055064
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:47:30 GMT

GET
H3 200 9943727809232435927
tpc.googlesyndication.com/simgad/ Frame ACEA 14 KB
14 KB 38ms
38ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9943727809232435927?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkwKx_lbgEimOI_FHoHpxnwMAZmfA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3318186299&adf=167829604&pi=t.aa~a.264113679~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280&nras=3&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=1542&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=Vu61l8Z359&p=https%3A//beautyticks.com&dtd=66

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3ae1f9d3bccf44ad0a7c8276c4e321fbac9a9a80202ff91807531b5a6162c417

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Dec 2021 11:00:37 GMT
x-content-type-options: nosniff
age: 110847
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14777
x-xss-protection: 0
last-modified: Fri, 22 Oct 2021 19:28:52 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 07 Dec 2022 11:00:37 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/ Frame ACEA 19 KB
8 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cd429ca4b699add93c19c2731a22a489a5a5d6d1d01445d337f8c89c8ca6eb2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:40:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 446
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7866
x-xss-protection: 0
server: cafe
etag: 5920091025124701355
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:40:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame ACEA 2 KB
1 KB 43ms
41ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:44:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame ACEA 119 KB
36 KB 393ms
391ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 08 Dec 2021 17:48:04 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame ACEA 15 KB
6 KB 38ms
36ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28277814cf8060f9fe40684129799beca6dc209f3b04c72ccde70b93c6c5c15b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6455
x-xss-protection: 0
server: cafe
etag: 3508882476506594800
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:41:40 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame ACEA 0
0 127ms
125ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQW6lNC6vaw092acz8iM0lql2sD2ZudOSNUyVUxDnbrh59xuzAof1PHzu9URXPFNyX3JpbReEKoYLzpYZjxU4EigcuTPw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3318186299&adf=167829604&pi=t.aa~a.264113679~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280&nras=3&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=1542&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=Vu61l8Z359&p=https%3A//beautyticks.com&dtd=66
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame ACEA 27 KB
11 KB 45ms
42ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

963c8078bf539ed77cedb3069b1c40cabd089543c09b429b7007fc06cbeac978

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Dec 2021 18:44:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83001
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11408
x-xss-protection: 0
server: cafe
etag: 810747636693205972
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Dec 2021 18:44:43 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame ACEA 0
0 70ms
68ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cfa7L0--wYYmGJciltOUP8dyT4ALR7f7-ZsCBl8nIDpKN0sLlKhABIO-o2X9g_YqihNQSoAHN3ImMA8gBAqgDAcgDyQSqBMsBT9A9eKaoCDpsfwFfxpWKPeavQHRcf5kK7zmubPmF1mW9qglUqbKsPmNq3_q8DJCMW2X0foo7GAUavAfvZbxJMCpQxtduu4zuPo1c3LEYBRqC2DH_UNW_mnR6bZy43tjpgjwwtf6Afkolp01ipINiWDQtTTly5HgrMO8rX6GWxcTmZuTxfTed5a3U81gs6NRdg7RqN7Tngp-3toIRIOmzJj67VLDlWiT-ZpVUyS3LSUhkzVWg40V_pXUxgtWl7yuFDpibegBNYbhoou3ABL_pw_ncA5IFBAgEGAGSBQQIBRgEoAYCgAebo_ZzqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQmPIC0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBmBYBgBcBshccChoIABIUcHViLTg2ODk0NjczNzI5NzQxODEYAA&sigh=wQISd0xQCHg&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3318186299&adf=167829604&pi=t.aa~a.264113679~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280&nras=3&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=1542&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=Vu61l8Z359&p=https%3A//beautyticks.com&dtd=66
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 08 Dec 2021 17:48:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/ Frame F820 53 KB
16 KB 39ms
39ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/index.html

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

807af920f70fe3546a49b5803a3ff6dabaf4ff9de7755bc493ff6c98492676f6

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
timing-allow-origin: *
date: Sun, 05 Dec 2021 12:59:49 GMT
expires: Mon, 05 Dec 2022 12:59:49 GMT
last-modified: Wed, 13 Oct 2021 19:12:48 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
content-length: 16647
age: 276495
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 104A 0
0 68ms
68ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CzaLy0--wYbOoJe-HtOUPmeGc4AzA67PiZcqR8P7fDtrZHhABIO-o2X9g_YqihNQSoAG8wsvLA8gBCakC3XHCmhb4sj6oAwHIA0iqBNQBT9DZ2ugpLbfce_SseEeKqM_cUfv6BPKH6wb8HJD_BZXLJdHB3xnqxM-taKic6oNWHbaPMVVU5ehPQaVhWp6FlvlmxLdnsxOe0bdCYW9k7nTbYiPXcE51ARf8aWRzCuzj3ezUX5TClMzgCoZeLiT5Hsw990Y5b-K_Xm0I1nbVmBOwc8Zha3Juppwsl767EfLETxRA8yJVVW3-GailtX059wl4-L98FX4sHUlMznSh7mnhUwAWPE0D51fmKEJxF2UjotAPjzicO1yzI2XuwU2tNrjBorzABKnQ4JfiA5IFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAesvbQ0qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQqa0F0ggJCIDhgBAQARgfgAoByAsB2BMNiBQD0BUBmBYBgBcBshccChoIABIUcHViLTg2ODk0NjczNzI5NzQxODEYAA&sigh=DllOn-zAj2M&uach_m=[UACH]&template_id=419

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3288300619&adf=1514954413&pi=t.aa~a.1192212056~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250&nras=4&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=2141&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=BJloijK7qg&p=https%3A//beautyticks.com&dtd=74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 08 Dec 2021 17:48:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/ Frame 104A 19 KB
8 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3288300619&adf=1514954413&pi=t.aa~a.1192212056~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250&nras=4&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=2141&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=BJloijK7qg&p=https%3A//beautyticks.com&dtd=74

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cd429ca4b699add93c19c2731a22a489a5a5d6d1d01445d337f8c89c8ca6eb2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:40:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 446
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7866
x-xss-protection: 0
server: cafe
etag: 5920091025124701355
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:40:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame 104A 2 KB
1 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:44:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 104A 119 KB
36 KB 305ms
304ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 08 Dec 2021 17:48:04 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame 104A 15 KB
6 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28277814cf8060f9fe40684129799beca6dc209f3b04c72ccde70b93c6c5c15b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6455
x-xss-protection: 0
server: cafe
etag: 3508882476506594800
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:41:40 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9315 143 B
167 B 25ms
25ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3318186299&adf=167829604&pi=t.aa~a.264113679~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280&nras=3&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=1542&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=Vu61l8Z359&p=https%3A//beautyticks.com&dtd=66

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 08 Dec 2021 16:58:32 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2972
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 11C1 1 KB
756 B 25ms
25ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 08 Dec 2021 13:26:12 GMT
expires: Thu, 09 Dec 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 15712
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F885 41 KB
15 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 13:58:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13793
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 08 Dec 2022 13:58:11 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 596A 1 KB
756 B 25ms
25ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 08 Dec 2021 13:26:12 GMT
expires: Thu, 09 Dec 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 15712
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E841 41 KB
15 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 13:58:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13793
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 08 Dec 2022 13:58:11 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E51A 1 KB
756 B 26ms
26ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 08 Dec 2021 13:26:12 GMT
expires: Thu, 09 Dec 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 15712
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame F885 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1285896d3c74e1596bd7f389c1183323d5d13109430f1427c47346591bae9e94

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/ Frame E055 10 KB
3 KB 89ms
88ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82b532b885ebdddfe95c311d9125d3d085dcb8ce9df20a56bf741693904a78a4

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
timing-allow-origin: *
content-length: 2924
date: Wed, 08 Dec 2021 17:48:04 GMT
expires: Thu, 08 Dec 2022 17:48:04 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 19 Oct 2021 06:16:38 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 32B0 0
0 68ms
68ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CTf6k0--wYZ_1JZWH9APng7CoDpS8wfFfo-Od3c0Ox5nz-fwcEAEg76jZf2D9iqKE1BKgAa3xhrYCyAEJqQLbXYMmHPuyPqgDAcgDSKoE6AFP0OLLArWG88a8yeLIoG9xwoc3jnPDRgoipNVDvk-qI1zkdfz8YF5VK_l-PdbV1G7hvxe--D0hlG8y7rkjpbtZs4ovPudNCYKKjX0j8csIriqkbu9kyFLEhuj9Hi-4Z1bSxhipTSh-PTREwowxBd9xZ53UNViAhWh_C94iht4YfGR9JZDOWQHLdjxooWnY86VFTmlg6Rzhpq64IoDdto2DGY5hcywLPJi6wGl4u4-rR0MyggHc6oGpSv6oUwGHVdKdyU7bZXsGgHHxRnoaTQzRNOlNlBZxHwOEv3X8UMz3WSye3lwLNUBhwAT4hvWqtgOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHu475yQGoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBBDxngvSCAkIgOGAEBABGB-ACgHICwHYEwLQFQGAFwGyFxwKGggAEhRwdWItODY4OTQ2NzM3Mjk3NDE4MRgA&sigh=m1_L-JLQxhI&uach_m=[UACH]&template_id=419

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=100&adk=3376572913&adf=109231892&pi=t.aa~a.2172648555~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x100&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=1&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250%2C390x280&nras=6&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=2826&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=yA85TodoMR&p=https%3A//beautyticks.com&dtd=82
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 08 Dec 2021 17:48:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/ Frame 32B0 19 KB
8 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=100&adk=3376572913&adf=109231892&pi=t.aa~a.2172648555~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x100&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=1&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250%2C390x280&nras=6&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=2826&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=yA85TodoMR&p=https%3A//beautyticks.com&dtd=82

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cd429ca4b699add93c19c2731a22a489a5a5d6d1d01445d337f8c89c8ca6eb2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:40:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 446
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7866
x-xss-protection: 0
server: cafe
etag: 5920091025124701355
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:40:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame 32B0 2 KB
1 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:44:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 32B0 119 KB
36 KB 242ms
242ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 08 Dec 2021 17:48:04 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/ Frame 32B0 15 KB
6 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211206/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28277814cf8060f9fe40684129799beca6dc209f3b04c72ccde70b93c6c5c15b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6455
x-xss-protection: 0
server: cafe
etag: 3508882476506594800
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Dec 2021 17:41:40 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/ Frame 66F4 4 KB
2 KB 63ms
28ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4b97dcc4e5265d3d2e8a74ea6490302e40cd9977430c9d9bcc02c1c241a46d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 1744
date: Sat, 04 Dec 2021 18:20:22 GMT
expires: Sun, 04 Dec 2022 18:20:22 GMT
last-modified: Thu, 26 Nov 2020 09:32:16 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
age: 343662
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F885 0
571 B 150ms
75ms Ping
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsslKqGDv603290kjM_GfKVSblW9UApMeeWy1yv5iOakSPypa97xc_5xF3JL_QwOnc77kyI5CcaSZNvAUAC9TuuZHfhVgBIbXVKg064VFTJ1rdS9yUbMEtJW8v5zpEucaCbPCqJOMTe8T1Tz5IJNVUNNDs-OqnvOVUBZIk_Py3qqIGEq3efEnmGj6hW1N1_9TMlPzjJrQovz5Rkmu1_PBt0Xj-XiQYN9GeAEXW1RAxs5kqK75XYJFANmNoz-J4vLIZQtAs81AI47n6TGZWmgJnVCHqASECaZGyPzY4X6mNH3whefzT6vC5GBdSDmEyvYtbkq1JnHwPtOi4gkIqRcEH5tIQngbbM7_AFUq_boxdJVQqGf65xjsCxgRxj6NSz4v3CvbxORCHBpyex4JlQUnYSeHLryza8MfJ5eUkP1berbRLpsFo0764UoXYdaAZvRh5hhfEi9M9Uj1u7Fvfsuv82Ajcj-sD_jwTmxNpCwroUCiCRs09S_P2R1-2fNRqCcC1kiWin0JlxoE-PrQfzW2rV4t5JIAnLMW1Veji0hEjcOQ_5ZClm-vp_8b-TCaemT7PA1YuXwpXxUZEticPJv6wnf1vrqyTRhbCZbEURdZ2CzmYijrp_QbjhwkB-9fLrfnyOoXOLdcFNQTq9zBrDovDQByE3XLF5V_elU9IMhLW5O5dsvDAwbNLtLkfF9AIjztNGgRMCyFhCdwE6pyXzMbDsenp0FTP20tYHvs2N-TvuRWXKH-e_5QEKRE_pMXxXhunLfwHiGmiThjRU9Mrtl9_VB0GQlcOJOxVW8zv6lXNZKluq03GjLTee4gSIClzEpYcpNJEwjs_zKxDhyvPZ-_dvfHMcUJSC49jpSnnaCuEmlYqTIWSSgHgecp5mMIKUZlVdmVWuC0DUf_8wbwheMERacs3qzwBq6cMKLRTbMwiJVoVtsGdb_pUm_Spn4XMbdzgVT7yTEqyoMAZE5aYyWqGbj10HsagAQmkd6I7T9jYhJ5Y0NZDzkeId-ShFwEGfU0GypwLO-HYti7l_andTXQ1dC5tcKgdf9J9qTrwA1bFVNn4osPcH8Uys4XrHJI9UuyzKjWJ5Z2d6jdPLUG4T4nmw32by-MZ2LSSetx8Y5DPtSG1mFZLCNL9EHBACfZAdM0oChhaFyl19Al5RrxQ&sai=AMfl-YTIBV_nbBJhENsPUX-_UWWfUDtccl83_Ab_Nlnrb0_VQ6QSMq70VaHJ09puieH9NZy1n07BehKnHrS05I03daqGVD61KOdseNSjn1-Znsn0wXLwy7OehDXBN_8br9i0NHDOJG51YqsokUWHOgwnyYncGOzTlA&sig=Cg0ArKJSzOZX2fSuHm22EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=195&cbvp=1&cstd=192&cisv=r20211206.76554&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 08 Dec 2021 17:48:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET img;adv=11122207570744;ec=11122226302456;adv.a=6266241;c.a=25084125;s.a=3213511;p.a=288877889;a.a=482642580;cache=3503233461;
ad.atdmt.com/i/ Frame F885 0
0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B1FA 143 B
167 B 25ms
25ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3288300619&adf=1514954413&pi=t.aa~a.1192212056~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250&nras=4&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=2141&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=BJloijK7qg&p=https%3A//beautyticks.com&dtd=74

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 08 Dec 2021 16:58:32 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2972
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame F820 9 KB
3 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 16:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5973
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 09 Dec 2021 16:08:31 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame F820 26 KB
10 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 16:13:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 09 Dec 2021 16:13:39 GMT

GET
H3 200 a1a14cc12f313ab551b63415b97470dd.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/ Frame F820 77 KB
20 KB 39ms
39ms Script
application/x-javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/a1a14cc12f313ab551b63415b97470dd.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eae170b97d752c817a4d707ab6ad73aeff7ca3d1f98f39b22f4ae40570101fa7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 276493
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20349
x-xss-protection: 0
last-modified: Wed, 13 Oct 2021 19:12:48 GMT
server: sffe
date: Sun, 05 Dec 2021 12:59:51 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 05 Dec 2022 12:59:51 GMT

POST
H3 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 104A 0
20 B 96ms
62ms Other
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPPd2rvh1PQCFe8DrQYdmTAHzA&gqi=0--wYdHKIMXH1fAPqKWc8As&layout=/sadbundle/%24csp%253Der3%24/14967257856070586351/index.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/ Frame C0D4 4 KB
2 KB 36ms
27ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4b97dcc4e5265d3d2e8a74ea6490302e40cd9977430c9d9bcc02c1c241a46d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 1744
date: Sat, 04 Dec 2021 18:20:22 GMT
expires: Sun, 04 Dec 2022 18:20:22 GMT
last-modified: Thu, 26 Nov 2020 09:32:16 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
age: 343662
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E841 0
61 B 129ms
80ms Ping
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssIn0Qj0ZvvloQRb1ptkOmlBf7DkvrTlXrehzKdURuQOIfpC2s-qSaVdfBfLtPST5gUhRHzcanA1YVaCjkD-ppIzIzVIdZzL5me8se47GuoSbmF3v-sRZoz9yqWSBDtecYEWo03ZemwB1zVeYeKx6kKCUW6PdU9PSVV5YPC1bPVF8fZcFuR3XWpcpU4LHh2iA9gghUPC49Wyc5BI8eH6Zu6ddmawpmJ6WdmKaO08z2U6MZEYIIWD1uc9dduBX3hlDexZPBNSyb_HENjBpdGEyDTc6wrLzxbpl9CYhyV2vihkRfwcmrJAhVeDhgx4JqVPExGH6nBTxBPG7fCmiK0WNw8PjO8zEo4_oITBX11o7GctlQiKbpuYDtGDhtdjbrB9mRp3QLgZaQQcuYc-zK2K_X4uzS6VsgktOZzzXttfaAjD8SvJdDnfS0JZ_XZklna7QYlEQDNfx1fhhT8QmeV2M84OLs7kNor5g4HV0NC949dI5RoAhVk1SIaUWcWhFfzj5qsG6UcDIk8J_gwaC7NHcldtOoZP-JyzXRurCK_cg_klw28jynpmdmjEpNze374LKg36HGSDbTbmJbqweMUgLdvBcsRlXEz_X2-yyW-UPuq_3ajuUD-yihstKp6V0MZkLOizhEcHvPc9iur3nP5p_GbaONoT1XTcWxbFT-LoX_hFGcvbUeUyEVKqs8plUegX0rD_0R5_JLBvxo5y1j6LC6ikFwrOjrnmbF-I7R5MZUHwyNJek37G4qJIDzNxnH9w52SCH0n9fwNZnHoql52hxIddYUmLv_r5ualrdl-vO3NcbzN1YoiMTmToExpzWHaMGJPeirnd-wqEkRfpd3zQgZNqziaGlTX0VYkiohUUtge_ZHZgnf7RLwrnheiFRLHoaTQKIIwEQqBO7VVvXxxzvuLDiIaKaIUjYrvG4efQbe35rVnN1qYuxfknDRAzfaOMf26m0_qKh4FT2BXtmXkl8Yx34atA_fY7XRufrNHPuSC8fuAbsPOGKLSyi5nQetBDfcgKeE0YqF5fico30A_Ie-AX-xYgYPoIdpjMWQB_1_7Lzh8WZadXnwb5Q-GQnBmFLBnogPmHehax7gHb4eh6i1Q43IIoFYiaD29ZWPcXOo-aDSmQEa5PCTiLnj9vFDPipwuDp597ctbfdeNMaM6bVmb9TCj&sai=AMfl-YT4jLsq8-n-4Dr29JjlSlsl7hOs9Qv49buolicW8E0oRv-coZWK4nSoz0qLTUFvVqIGCkHK6Oc5EKYo9nE4Zz6F89BzeMoIV5SE09C8hH1ibhtucLRL-OhN0HNA8gh4S9hT6qovL5DqSsPuxvMWwY1yDv8_2Q&sig=Cg0ArKJSzGbVgYvvjQijEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=208&cbvp=1&cstd=206&cisv=r20211206.50638&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 08 Dec 2021 17:48:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET img;adv=11122207570744;ec=11122226302456;adv.a=6266241;c.a=25084125;s.a=3213511;p.a=288877889;a.a=482642580;cache=4228277601;
ad.atdmt.com/i/ Frame E841 0
0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 181C 143 B
167 B 26ms
25ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=100&adk=3376572913&adf=109231892&pi=t.aa~a.2172648555~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x100&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=1&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250%2C390x280&nras=6&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=2826&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=yA85TodoMR&p=https%3A//beautyticks.com&dtd=82

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 08 Dec 2021 16:58:32 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2972
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8872 22 KB
8 KB 37ms
37ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 08 Dec 2021 13:58:12 GMT
expires: Thu, 08 Dec 2022 13:58:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 13792
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0B6A 22 KB
8 KB 38ms
37ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 08 Dec 2021 13:58:12 GMT
expires: Thu, 08 Dec 2022 13:58:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 13792
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 32B0 0
20 B 60ms
59ms Other
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CN-q27vh1PQCFZUDfQod5wEM5Q&gqi=0--wYY2RIbTWxgOAp6vQBQ&layout=/sadbundle/%24csp%253Der3%24/11839137306054191879/index.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 11C1
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJjwsgmQgETvOsZ0pD_w9aaLfYJdti4y_zjxNt...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWJEdjFBQUFCYnAwelFmeQ&google_push=AYg5qPJjwsgmQgETvOsZ0pD_w9aaLfYJdti4y_zjxNtaVBcGfO98K0aFRTAENf82VB7FVeuSLqI4tWQe28EzN8o5C5bJ0JkLc4CO

170 B
188 B

35ms
35ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWJEdjFBQUFCYnAwelFmeQ&google_push=AYg5qPJjwsgmQgETvOsZ0pD_w9aaLfYJdti4y_zjxNtaVBcGfO98K0aFRTAENf82VB7FVeuSLqI4tWQe28EzN8o5C5bJ0JkLc4CO

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWJEdjFBQUFCYnAwelFmeQ&google_push=AYg5qPJjwsgmQgETvOsZ0pD_w9aaLfYJdti4y_zjxNtaVBcGfO98K0aFRTAENf82VB7FVeuSLqI4tWQe28EzN8o5C5bJ0JkLc4CO
Date: Wed, 08 Dec 2021 17:48:04 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 11C1
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEL48pA-9-hl9mCXIMSTLGDs&google_cver=1&google_push=AYg5qPIYkh2_YOLIyu1ZpuyGCu_HiZ7KEPYHFGu9mzedcaMflbrUkPvVmoDe7AZ6J85YNCIvhGc-t7sW0kMZkdmDZAR9ALf9oqjv3w
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIYkh2_YOLIyu1ZpuyGCu_HiZ7KEPYHFGu9mzedcaMflbrUkPvVmoDe7AZ6J85YNCIvhGc-t7sW0kMZkdmDZAR9ALf9oqjv3w&google_hm=Q0FFU0VMNDhwQS05LWh...

170 B
188 B

37ms
36ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIYkh2_YOLIyu1ZpuyGCu_HiZ7KEPYHFGu9mzedcaMflbrUkPvVmoDe7AZ6J85YNCIvhGc-t7sW0kMZkdmDZAR9ALf9oqjv3w&google_hm=Q0FFU0VMNDhwQS05LWhsOW1DWElNU1RMR0Rz

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 08 Dec 2021 17:48:04 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIYkh2_YOLIyu1ZpuyGCu_HiZ7KEPYHFGu9mzedcaMflbrUkPvVmoDe7AZ6J85YNCIvhGc-t7sW0kMZkdmDZAR9ALf9oqjv3w&google_hm=Q0FFU0VMNDhwQS05LWhsOW1DWElNU1RMR0Rz
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 11C1
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPLNXOfYIyAWgvl801ETgFHaRdTMBfTSRcJAtAz13DJTiQ5-vOm2vCwQj8VKSuO6R9KogH6v5Q4PUesrsZMlyxL5V23S_LJHkQ&google_gid=CAESEEm07vMzu9KUpMKQ116IOHg&g...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCNTfw40GEgUI6AcQAEIASnJnb29nbGVfcHVzaD1BWWc1cVBMTlhPZllJeUFXZ3ZsODAxRVRnRkhhUmRUTUJmVFNSY0pBdEF6MTNESlRpUTUtdk9tMnZDd1FqOFZLU3VPNlI5S29nSDZ2NVE0UFVlc3JzWk...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwSUZkdGlRWFBKYVdMRzBCbmI0aGxSQnMyc0hlSzN6NXlvOVMyaUx6dlRIVQ==&google_push

170 B
188 B

37ms
37ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwSUZkdGlRWFBKYVdMRzBCbmI0aGxSQnMyc0hlSzN6NXlvOVMyaUx6dlRIVQ==&google_push

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 08 Dec 2021 17:48:04 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwSUZkdGlRWFBKYVdMRzBCbmI0aGxSQnMyc0hlSzN6NXlvOVMyaUx6dlRIVQ==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 11C1
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKvCpx8...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKvCpx8...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDgxNzQ4MDUwMDAzODgxNzk1ODk3NQ%3D%3D&google_push=AYg5qPKvCpx8rq_LaiUYA__Y9FDUomn1-Nai-GKWhYpEy7zuIfBwGBUtYGB5OGbmal7TsO...

170 B
188 B

38ms
37ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDgxNzQ4MDUwMDAzODgxNzk1ODk3NQ%3D%3D&google_push=AYg5qPKvCpx8rq_LaiUYA__Y9FDUomn1-Nai-GKWhYpEy7zuIfBwGBUtYGB5OGbmal7TsONyKHGqm8-VtB91xwB9HN_i1_7SzvRp4A

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDgxNzQ4MDUwMDAzODgxNzk1ODk3NQ%3D%3D&google_push=AYg5qPKvCpx8rq_LaiUYA__Y9FDUomn1-Nai-GKWhYpEy7zuIfBwGBUtYGB5OGbmal7TsONyKHGqm8-VtB91xwB9HN_i1_7SzvRp4A
pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Wed, 08 Dec 2021 17:48:05 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 11C1
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=QOro0ZjAQvKXWZfqzLETYw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

38ms
37ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=QOro0ZjAQvKXWZfqzLETYw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKZChwADwF8L71VH0Nz-fYYKOALZq_9A571okIn7jrLuwFiku26mHcxUmZVL0F_k5-B16RpzPN1q7X3gQ0BV0kIbkblP2jJ

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=QOro0ZjAQvKXWZfqzLETYw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKZChwADwF8L71VH0Nz-fYYKOALZq_9A571okIn7jrLuwFiku26mHcxUmZVL0F_k5-B16RpzPN1q7X3gQ0BV0kIbkblP2jJ
date: Wed, 08 Dec 2021 17:48:04 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET

pixel
cm.g.doubleclick.net/ Frame 11C1
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZt...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 11C1
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEAphpZuqAntzk9LucHBYTsA&google_cver=1&google_push=AYg5qPJtvVZZlIIJumgWxSQF...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJtvVZZlIIJumgWxSQF02eskDrNg7afGP-yIljGQ2jcIvyVY6nAHMe7CpAMEAUQSWXlPT_84Df_hHp7oO9zqj9dcAxzqldvq_k&google_hm=

170 B
188 B

37ms
37ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJtvVZZlIIJumgWxSQF02eskDrNg7afGP-yIljGQ2jcIvyVY6nAHMe7CpAMEAUQSWXlPT_84Df_hHp7oO9zqj9dcAxzqldvq_k&google_hm=

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJtvVZZlIIJumgWxSQF02eskDrNg7afGP-yIljGQ2jcIvyVY6nAHMe7CpAMEAUQSWXlPT_84Df_hHp7oO9zqj9dcAxzqldvq_k&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Tue, 07 Dec 2021 17:48:04 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 11C1 0
12 B 39ms
34ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LWqFMFYXegc2rZpj-ATFUkaJVOWI__J_0wE1eSfjNe1-Pdn9NrlMfuzVBxZ9ZOyxxF9B8OLQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dpixel
cms.quantserve.com/ Frame 596A 35 B
463 B 105ms
28ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMkl9pzcBfU7_CH8pZWwu8w&google_cver=1&google_push=AYg5qPKAsu_R0ZFt9Aw4DZe-h34PZ6TrAQ6PmX51FzV7O2eIkVtmhU3pOQni_uZRoJw8BoMglRd9bHadedCRJ-T3x5evNDNKoyERVXSQOoQU3kg0JLneXF449Szxi-vjQI2HIfZr3yu6PfqAEP-wzMI83eU

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 466606.gif
id.rlcdn.com/ Frame 596A 42 B
189 B 65ms
34ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPLuTeDdtgwgDBPCmJEcP5OfSCEdwUGKP0QFGbDyj8BgOHb-Bl4osjlNycD_H6jobUg42PMA3ZgGFVSrLH4UFi2TNg3rgyoDWLc0uORD_AbdbmsKZ2Da7KrTyNTf8DhoQMqmCiiGpQK3ia6w7Nk_VJ4&google_gid=CAESEMZFeuUNH5duSbr6UEcYeUE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3332885161&adf=3836665116&pi=t.aa~a.3491345329~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=2&bdt=1198&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0&nras=2&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=pbV4puejKF&p=https%3A//beautyticks.com&dtd=20
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Dec 2021 17:48:04 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 596A
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIuxVgB...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIuxVgB...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDgxNzQ4MDUwMDA0ODA3OTg0NjE3NA%3D%3D&google_push=AYg5qPIuxVgBh_A74DUNmCnvpbSmBj3fj5flFG0xQcK3XorlzaIDBh7R6vmxVhclBfmjbh...

170 B
188 B

36ms
36ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDgxNzQ4MDUwMDA0ODA3OTg0NjE3NA%3D%3D&google_push=AYg5qPIuxVgBh_A74DUNmCnvpbSmBj3fj5flFG0xQcK3XorlzaIDBh7R6vmxVhclBfmjbhfyZv5ReGtYAFqdCNCHiSzYBbs54KY6RKnixfKAmUYfd8G3U5SlRHEc9cgTcF5Ehs_srKzyERaXubsmYeNP1yI

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDgxNzQ4MDUwMDA0ODA3OTg0NjE3NA%3D%3D&google_push=AYg5qPIuxVgBh_A74DUNmCnvpbSmBj3fj5flFG0xQcK3XorlzaIDBh7R6vmxVhclBfmjbhfyZv5ReGtYAFqdCNCHiSzYBbs54KY6RKnixfKAmUYfd8G3U5SlRHEc9cgTcF5Ehs_srKzyERaXubsmYeNP1yI
pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Wed, 08 Dec 2021 17:48:05 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 596A 43 B
324 B 72ms
34ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEBGhC_dV9a2BzG8YNbmeo-U&google_push=AYg5qPKJslt1S28D1knG3TGvx-DwEhA01stC2mSTl1mU79ioqXzLKv_xTDcXA7UUeoDPaocZA_6W96OmoQ8eFClURpbqXbb6YISp1JDvzkzsEAOCp8kq2hiMmL6B9sSqgi2Qo2Bh5-Hpa-BJnxL1EIXJu_I&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3332885161&adf=3836665116&pi=t.aa~a.3491345329~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=2&bdt=1198&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0&nras=2&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=pbV4puejKF&p=https%3A//beautyticks.com&dtd=20
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 596A 43 B
134 B 80ms
42ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEBkcW-7g-jXcEuiUbZKqw8I&google_cver=1&google_push=AYg5qPK4eLZi-2P8pfDQCCPMcrljPXTEzTp6hL0CK3tSXtVurW1-pSIPwKxn9Y199FgSxj-KneNbK-ig8AJQ481cUcnTk1BJX-4Yx9wq8Aet6dxQYBTWmEnSmEXaKihbbVewxPDpKn5tIc6Oywz5XFz6Zvc
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3332885161&adf=3836665116&pi=t.aa~a.3491345329~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=2&bdt=1198&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0&nras=2&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1213&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=pbV4puejKF&p=https%3A//beautyticks.com&dtd=20
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: lihd6pos07ekumc040r1qi4j6bf4i1t9

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 596A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEC6NZTHiI0FvIseAZE78K4k&google_cver=1&google_push=AYg5qPIrUXpzUYMrqfrG7VLgPNqaTVaFvL11h8Bej4anE97uv4MpiCB153YcrXA35-yapt_GJTL...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dYVFJDS0gtMTgtRk9CVw==&google_push=AYg5qPIrUXpzUYMrqfrG7VLgPNqaTVaFvL11h8Bej4anE97uv4MpiCB153YcrXA35-yapt_GJTL18R2sAavMa1Qbz9KGzSUbP3iTi...

170 B
188 B

37ms
36ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dYVFJDS0gtMTgtRk9CVw==&google_push=AYg5qPIrUXpzUYMrqfrG7VLgPNqaTVaFvL11h8Bej4anE97uv4MpiCB153YcrXA35-yapt_GJTL18R2sAavMa1Qbz9KGzSUbP3iTiHIgvR2h9_xZ_d-CPWdAyVdsi5P1OMl-Z0TAs7em6_U156cqd04ben0

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dYVFJDS0gtMTgtRk9CVw==&google_push=AYg5qPIrUXpzUYMrqfrG7VLgPNqaTVaFvL11h8Bej4anE97uv4MpiCB153YcrXA35-yapt_GJTL18R2sAavMa1Qbz9KGzSUbP3iTiHIgvR2h9_xZ_d-CPWdAyVdsi5P1OMl-Z0TAs7em6_U156cqd04ben0
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6683ee3a8662a9679fcacb9fe223a3f8
Expires: 0

GET
H2

200

dot.gif
googlecm.hit.gemius.pl/ Frame 596A
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEJevCCM9IRtCwdxbaDiVGFI&google_cver=1&google_push=AYg5qPJm7zgenk7ee4qsRG1F...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJm7zgenk7ee4qsRG1F8wBGtGZr9L0V5KrzbIdxgiqwTCgaaMWcqIRXuGssJO4QEqfHUiWH_rQXdO4h3YEz-GZbave9JkW2JWhwfnAN8FivIWOO3IbfSY&googl...
https://googlecm.hit.gemius.pl/dot.gif?id=pyM1l.MgAY658jQJ4ykHpoYhP_hR_2_qZ3eEDY6uHMX.C7&google_error=5

43 B
235 B

45ms
45ms

Image
image/gif

217.182.200.19
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googlecm.hit.gemius.pl/dot.gif?id=pyM1l.MgAY658jQJ4ykHpoYhP_hR_2_qZ3eEDY6uHMX.C7&google_error=5
Requested by: Host: beautyticks.com
URL: https://beautyticks.com/
Protocol: H2
Server: 217.182.200.19 , France, ASN16276 (OVH, FR),
Reverse DNS: gcm5.host.hit.gemius.pl
Software: GHC /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-type: image/gif
content-length: 43
expires: Tue, 07 Dec 2021 17:48:05 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://googlecm.hit.gemius.pl/dot.gif?id=pyM1l.MgAY658jQJ4ykHpoYhP_hR_2_qZ3eEDY6uHMX.C7&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 304
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 596A 0
12 B 34ms
33ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JgmY7xEskVBxKABRMeOAd7zZMbAY3ocRG2pe6E1tLhttx9AtHVaa85V8we2wNEd4xTmKak6w

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dpixel
cms.quantserve.com/ Frame E51A 35 B
463 B 102ms
29ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEBtZl4Ls_uKc7ku_WYkhS7E&google_cver=1&google_push=AYg5qPJHdqhzcNPrKsp2DqSwP0fS64yafdOcnW_sJSb67dq7FXL5jKRjb02gETFVTZzU8t2MGjtdJRzvOPwH-AWSDVr-yEl0Feo0

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame E51A 43 B
106 B 69ms
34ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEKi1j_GU_5VNqnG0gqU_bdI&google_push=AYg5qPJGObc3JXcIWakEzxaCyrv6muOIKMVN2WHXHg3PE_BJjzybeYzi0VaySqt2CtYpy31S76uPsh1v9myK113Gb05Ftm2rReC7&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3584321639&adf=3048362026&pi=t.aa~a.2659481085~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250&nras=5&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=2405&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=PSI4l760Ij&p=https%3A//beautyticks.com&dtd=77
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame E51A 43 B
352 B 69ms
35ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEKeOymgx1qdZnBg4v933JE4&google_cver=1&google_push=AYg5qPIq7yspH8sFXpolp4DgSFxXkiDs10r4ZsG-QMb6cY_EjTzkTNZS3IyEv8sSmrbYboY7vMoooT2QY1LejtU3_ShpM6A50MA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=280&adk=3584321639&adf=3048362026&pi=t.aa~a.2659481085~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x280&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250&nras=5&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=2405&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=PSI4l760Ij&p=https%3A//beautyticks.com&dtd=77
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: kfctrj6dggvrpqrofr21jv17qq60jlf0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E51A
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=OFnYjFs_TuKbwVPLx5BHDw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

38ms
38ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=OFnYjFs_TuKbwVPLx5BHDw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKEBDkVMhBcQmOogL-aTfc6ykyjNhISBP49eqOkKgurbc30YKOxeAqHhjPU7P4knRZrEpXwa-xW7rF9gxPGm96Pl8EeHxGr

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=OFnYjFs_TuKbwVPLx5BHDw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKEBDkVMhBcQmOogL-aTfc6ykyjNhISBP49eqOkKgurbc30YKOxeAqHhjPU7P4knRZrEpXwa-xW7rF9gxPGm96Pl8EeHxGr
date: Wed, 08 Dec 2021 17:48:03 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E51A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPq_LXZ_lium2xSnMA4srP4&google_cver=1&google_push=AYg5qPKwt9ssBXdAm6BOIQhuRKhZs1EaAn0l0PPc3sG-e4EKB1wT2Z3PnSOaCZrmnM0UOdzmGaK...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dYVFJDS0otMjEtR1pKNg==&google_push=AYg5qPKwt9ssBXdAm6BOIQhuRKhZs1EaAn0l0PPc3sG-e4EKB1wT2Z3PnSOaCZrmnM0UOdzmGaKl_S23CTWl-67ODqZW2O2QdqCb

170 B
188 B

36ms
36ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dYVFJDS0otMjEtR1pKNg==&google_push=AYg5qPKwt9ssBXdAm6BOIQhuRKhZs1EaAn0l0PPc3sG-e4EKB1wT2Z3PnSOaCZrmnM0UOdzmGaKl_S23CTWl-67ODqZW2O2QdqCb

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dYVFJDS0otMjEtR1pKNg==&google_push=AYg5qPKwt9ssBXdAm6BOIQhuRKhZs1EaAn0l0PPc3sG-e4EKB1wT2Z3PnSOaCZrmnM0UOdzmGaKl_S23CTWl-67ODqZW2O2QdqCb
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6683ee3a8662a9679fcacb9fe223a3f8
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame E51A
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkr...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E51A
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEF0gGaYcGhynpqoeJ07Hp8Y&google_cver=1&google_push=AYg5qPI3_ClLn-6IZF_ru2sk...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPI3_ClLn-6IZF_ru2skA_yO-bj_a7CDrueuueHVW-qtir1Y3YOlGVyapu_ei8l3jKX-Ql0k2Z8PTZ0wsPdq75IPvG38Ha9ebg&google_hm=

170 B
188 B

38ms
38ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPI3_ClLn-6IZF_ru2skA_yO-bj_a7CDrueuueHVW-qtir1Y3YOlGVyapu_ei8l3jKX-Ql0k2Z8PTZ0wsPdq75IPvG38Ha9ebg&google_hm=

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:04 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPI3_ClLn-6IZF_ru2skA_yO-bj_a7CDrueuueHVW-qtir1Y3YOlGVyapu_ei8l3jKX-Ql0k2Z8PTZ0wsPdq75IPvG38Ha9ebg&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Tue, 07 Dec 2021 17:48:04 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E51A 0
12 B 34ms
34ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ILxgW3DCwG8GV_6y66qddVB6MWz9MMSI2TR4vLU2qBMEeOLPwSpjd_IrxIbUOzW1c1nq7F9Q

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:04 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame E055 9 KB
3 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 16:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5973
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 09 Dec 2021 16:08:31 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame E055 26 KB
10 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 16:13:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 09 Dec 2021 16:13:39 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame E055 1020 B
416 B 41ms
40ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Questrial:regular&cb=1634196250

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0bfa9b1629f8060bbddfae32fbd6dfd8b9b18c0d39ef5041b4ea12469712fff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Dec 2021 17:43:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 08 Dec 2021 17:48:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Dec 2021 17:48:04 GMT

GET
H3 200 gsap_3.2.4_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame E055 57 KB
23 KB 78ms
77ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23276
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 03:53:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Dec 2021 17:48:04 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9315
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
22 B

85ms
85ms

Document
text/html

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Dec 2021 17:48:04 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 css
fonts.googleapis.com/ Frame F820 4 KB
619 B 41ms
41ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400|Roboto:700

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14967257856070586351/a1a14cc12f313ab551b63415b97470dd.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8aed12b8b95a1d49011f3e134dc8e71804a3576818d1d1334145aaa96d71aa5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Dec 2021 17:48:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 08 Dec 2021 17:48:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Dec 2021 17:48:04 GMT

GET
H3 200 lottie_light.min.js Show response
s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/ Frame C0D4 153 KB
42 KB 29ms
28ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/lottie_light.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

063d8985f8245469e0ef35d725dd72afc824bc022a766b3cfafd66952b0a25ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 04 Dec 2021 18:20:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343661
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42924
x-xss-protection: 0
last-modified: Thu, 26 Nov 2020 09:32:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 04 Dec 2022 18:20:23 GMT

GET
H3 200 lottie_light.min.js Show response
s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/ Frame 66F4 153 KB
42 KB 41ms
41ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/lottie_light.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

063d8985f8245469e0ef35d725dd72afc824bc022a766b3cfafd66952b0a25ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 04 Dec 2021 18:20:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343661
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42924
x-xss-protection: 0
last-modified: Thu, 26 Nov 2020 09:32:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 04 Dec 2022 18:20:23 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B1FA
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
22 B

105ms
105ms

Document
text/html

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Dec 2021 17:48:04 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 181C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
22 B

142ms
142ms

Document
text/html

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 08 Dec 2021 17:48:05 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Dec 2021 17:48:05 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 08 Dec 2021 17:48:04 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js Show response
pagead2.googlesyndication.com/bg/ Frame 8872 35 KB
13 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969b16dbf7df3d84d9f2b6498dbd14531a8de0cb889e0532a9d1fd3f1f3c46b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:06:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2489
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13349
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 17:06:35 GMT

GET
H3 200 lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js Show response
pagead2.googlesyndication.com/bg/ Frame 0B6A 35 KB
13 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969b16dbf7df3d84d9f2b6498dbd14531a8de0cb889e0532a9d1fd3f1f3c46b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:06:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2489
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13349
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 17:06:35 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame F820 15 KB
15 KB 27ms
26ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400|Roboto:700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 13:39:48 GMT
x-content-type-options: nosniff
age: 446896
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 03 Dec 2022 13:39:48 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame F820 15 KB
15 KB 30ms
29ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400|Roboto:700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 17:56:19 GMT
x-content-type-options: nosniff
age: 604305
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 01 Dec 2022 17:56:19 GMT

GET
DATA 200
OK truncated
/ Frame F820 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5cb3856955a3ac59ae634eb7e8dad9290ab10e3cbdef65164b895e107b524da3

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H3 200 data.json Show response
s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/ Frame C0D4 127 KB
14 KB 29ms
29ms XHR
application/json 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/data.json

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/lottie_light.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aeb5c1cfe639ecc74723d7628bc75d6db0c59448fc556fd3f0bc4ea2ac88d05e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 04 Dec 2021 18:20:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343661
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14461
x-xss-protection: 0
last-modified: Thu, 26 Nov 2020 09:32:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 04 Dec 2022 18:20:23 GMT

GET
H3 200 imagesx0fuls4crfph0unywga6.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/ Frame E055 1 KB
1 KB 37ms
37ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/imagesx0fuls4crfph0unywga6.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04903a826114bcc047b38127ec4af079e6967f1ea4d44e6bd7158f24f954535f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 215281
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1393
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 06:16:38 GMT
server: sffe
date: Mon, 06 Dec 2021 06:00:03 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 06 Dec 2022 06:00:03 GMT

GET
H3 200 c3855b389843cb5cead33ad1ef84a642.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/ Frame E055 14 KB
14 KB 38ms
37ms Image
image/gif 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/c3855b389843cb5cead33ad1ef84a642.gif

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b67d71fb92839c0cc9c4380be72cc943f99039f7c0766bbbc0a552d9d6a1370f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 215281
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13860
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 06:16:38 GMT
server: sffe
date: Mon, 06 Dec 2021 06:00:03 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 06 Dec 2022 06:00:03 GMT

GET
H3 200 QdVUSTchPBm7nuUeVf70viFl.woff2
fonts.gstatic.com/s/questrial/v13/ Frame E055 19 KB
19 KB 27ms
26ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/questrial/v13/QdVUSTchPBm7nuUeVf70viFl.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Questrial:regular&cb=1634196250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62a17bc7232cf7af5c41ff98ec5a59d300d586773b5850e460aea5387f60c8b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 18:03:36 GMT
x-content-type-options: nosniff
age: 603868
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19404
x-xss-protection: 0
last-modified: Wed, 24 Mar 2021 17:43:25 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 01 Dec 2022 18:03:36 GMT

GET
H3 200 data.json Show response
s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/ Frame 66F4 127 KB
14 KB 26ms
26ms XHR
application/json 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/data.json

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/lottie_light.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aeb5c1cfe639ecc74723d7628bc75d6db0c59448fc556fd3f0bc4ea2ac88d05e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11400054110905720812/336x280/banner/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 04 Dec 2021 18:20:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343661
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14461
x-xss-protection: 0
last-modified: Thu, 26 Nov 2020 09:32:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 04 Dec 2022 18:20:23 GMT

GET
DATA 200
OK truncated
/ Frame 32B0 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f77f54ef179b3954e26d7d5f9a2328e62c3930070c876edb89c1d84738b47b17

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 104A 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5cfff9fb75787c224e95cd3a90817961c33dcb18e859cb3d8353d7ce0516e4f7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame E841 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c41a2ab320e3ed0711d262941fc8b4202d4825f55bbdb157a98b3c96f24f54d0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E841 0
23 B 118ms
74ms Ping
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssIn0Qj0ZvvloQRb1ptkOmlBf7DkvrTlXrehzKdURuQOIfpC2s-qSaVdfBfLtPST5gUhRHzcanA1YVaCjkD-ppIzIzVIdZzL5me8se47GuoSbmF3v-sRZoz9yqWSBDtecYEWo03ZemwB1zVeYeKx6kKCUW6PdU9PSVV5YPC1bPVF8fZcFuR3XWpcpU4LHh2iA9gghUPC49Wyc5BI8eH6Zu6ddmawpmJ6WdmKaO08z2U6MZEYIIWD1uc9dduBX3hlDexZPBNSyb_HENjBpdGEyDTc6wrLzxbpl9CYhyV2vihkRfwcmrJAhVeDhgx4JqVPExGH6nBTxBPG7fCmiK0WNw8PjO8zEo4_oITBX11o7GctlQiKbpuYDtGDhtdjbrB9mRp3QLgZaQQcuYc-zK2K_X4uzS6VsgktOZzzXttfaAjD8SvJdDnfS0JZ_XZklna7QYlEQDNfx1fhhT8QmeV2M84OLs7kNor5g4HV0NC949dI5RoAhVk1SIaUWcWhFfzj5qsG6UcDIk8J_gwaC7NHcldtOoZP-JyzXRurCK_cg_klw28jynpmdmjEpNze374LKg36HGSDbTbmJbqweMUgLdvBcsRlXEz_X2-yyW-UPuq_3ajuUD-yihstKp6V0MZkLOizhEcHvPc9iur3nP5p_GbaONoT1XTcWxbFT-LoX_hFGcvbUeUyEVKqs8plUegX0rD_0R5_JLBvxo5y1j6LC6ikFwrOjrnmbF-I7R5MZUHwyNJek37G4qJIDzNxnH9w52SCH0n9fwNZnHoql52hxIddYUmLv_r5ualrdl-vO3NcbzN1YoiMTmToExpzWHaMGJPeirnd-wqEkRfpd3zQgZNqziaGlTX0VYkiohUUtge_ZHZgnf7RLwrnheiFRLHoaTQKIIwEQqBO7VVvXxxzvuLDiIaKaIUjYrvG4efQbe35rVnN1qYuxfknDRAzfaOMf26m0_qKh4FT2BXtmXkl8Yx34atA_fY7XRufrNHPuSC8fuAbsPOGKLSyi5nQetBDfcgKeE0YqF5fico30A_Ie-AX-xYgYPoIdpjMWQB_1_7Lzh8WZadXnwb5Q-GQnBmFLBnogPmHehax7gHb4eh6i1Q43IIoFYiaD29ZWPcXOo-aDSmQEa5PCTiLnj9vFDPipwuDp597ctbfdeNMaM6bVmb9TCj&sai=AMfl-YT4jLsq8-n-4Dr29JjlSlsl7hOs9Qv49buolicW8E0oRv-coZWK4nSoz0qLTUFvVqIGCkHK6Oc5EKYo9nE4Zz6F89BzeMoIV5SE09C8hH1ibhtucLRL-OhN0HNA8gh4S9hT6qovL5DqSsPuxvMWwY1yDv8_2Q&sig=Cg0ArKJSzGbVgYvvjQijEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=502&vt=11&dtpt=294&dett=3&cstd=206&cisv=r20211206.50638&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 08 Dec 2021 17:48:05 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F885 0
23 B 82ms
72ms Ping
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsslKqGDv603290kjM_GfKVSblW9UApMeeWy1yv5iOakSPypa97xc_5xF3JL_QwOnc77kyI5CcaSZNvAUAC9TuuZHfhVgBIbXVKg064VFTJ1rdS9yUbMEtJW8v5zpEucaCbPCqJOMTe8T1Tz5IJNVUNNDs-OqnvOVUBZIk_Py3qqIGEq3efEnmGj6hW1N1_9TMlPzjJrQovz5Rkmu1_PBt0Xj-XiQYN9GeAEXW1RAxs5kqK75XYJFANmNoz-J4vLIZQtAs81AI47n6TGZWmgJnVCHqASECaZGyPzY4X6mNH3whefzT6vC5GBdSDmEyvYtbkq1JnHwPtOi4gkIqRcEH5tIQngbbM7_AFUq_boxdJVQqGf65xjsCxgRxj6NSz4v3CvbxORCHBpyex4JlQUnYSeHLryza8MfJ5eUkP1berbRLpsFo0764UoXYdaAZvRh5hhfEi9M9Uj1u7Fvfsuv82Ajcj-sD_jwTmxNpCwroUCiCRs09S_P2R1-2fNRqCcC1kiWin0JlxoE-PrQfzW2rV4t5JIAnLMW1Veji0hEjcOQ_5ZClm-vp_8b-TCaemT7PA1YuXwpXxUZEticPJv6wnf1vrqyTRhbCZbEURdZ2CzmYijrp_QbjhwkB-9fLrfnyOoXOLdcFNQTq9zBrDovDQByE3XLF5V_elU9IMhLW5O5dsvDAwbNLtLkfF9AIjztNGgRMCyFhCdwE6pyXzMbDsenp0FTP20tYHvs2N-TvuRWXKH-e_5QEKRE_pMXxXhunLfwHiGmiThjRU9Mrtl9_VB0GQlcOJOxVW8zv6lXNZKluq03GjLTee4gSIClzEpYcpNJEwjs_zKxDhyvPZ-_dvfHMcUJSC49jpSnnaCuEmlYqTIWSSgHgecp5mMIKUZlVdmVWuC0DUf_8wbwheMERacs3qzwBq6cMKLRTbMwiJVoVtsGdb_pUm_Spn4XMbdzgVT7yTEqyoMAZE5aYyWqGbj10HsagAQmkd6I7T9jYhJ5Y0NZDzkeId-ShFwEGfU0GypwLO-HYti7l_andTXQ1dC5tcKgdf9J9qTrwA1bFVNn4osPcH8Uys4XrHJI9UuyzKjWJ5Z2d6jdPLUG4T4nmw32by-MZ2LSSetx8Y5DPtSG1mFZLCNL9EHBACfZAdM0oChhaFyl19Al5RrxQ&sai=AMfl-YTIBV_nbBJhENsPUX-_UWWfUDtccl83_Ab_Nlnrb0_VQ6QSMq70VaHJ09puieH9NZy1n07BehKnHrS05I03daqGVD61KOdseNSjn1-Znsn0wXLwy7OehDXBN_8br9i0NHDOJG51YqsokUWHOgwnyYncGOzTlA&sig=Cg0ArKJSzOZX2fSuHm22EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=547&vt=11&dtpt=352&dett=3&cstd=192&cisv=r20211206.76554&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: beautyticks.com
URL: https://beautyticks.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 08 Dec 2021 17:48:05 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame ACEA 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d4155dd8184947f5b6cc19c91d2c70489e9d0ff63a53aeab46bdcaabf6d02c1b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js Show response
pagead2.googlesyndication.com/bg/ Frame F820 35 KB
13 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969b16dbf7df3d84d9f2b6498dbd14531a8de0cb889e0532a9d1fd3f1f3c46b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:06:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2490
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13349
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 17:06:35 GMT

GET
H3 200 lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js Show response
pagead2.googlesyndication.com/bg/ Frame CA7D 35 KB
13 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969b16dbf7df3d84d9f2b6498dbd14531a8de0cb889e0532a9d1fd3f1f3c46b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:06:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2490
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13349
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 17:06:35 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 43ms
43ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211206&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1aaf4c318c2bf3c8877eea6fa5edf9ccb51344b19aff310e4d1a488f3f58f6a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Dec 2021 17:48:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8535
x-xss-protection: 0

GET
H3 200 lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js Show response
pagead2.googlesyndication.com/bg/ Frame E055 35 KB
13 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969b16dbf7df3d84d9f2b6498dbd14531a8de0cb889e0532a9d1fd3f1f3c46b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:06:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2490
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13349
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 17:06:35 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:48:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
expires: Wed, 08 Dec 2021 17:48:05 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6269 13 KB
5 KB 36ms
36ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
date: Wed, 08 Dec 2021 17:46:14 GMT
expires: Thu, 08 Dec 2022 17:46:14 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 111
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0BC5 783 B
534 B 38ms
38ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0d5fe8f39f2e929e3f5dc82ae1a85fc478b21d87988430fe0a663f5426947a9c

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-d1ucGhWu9MJly3x8gEGyVw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Wed, 08 Dec 2021 17:48:05 GMT
date: Wed, 08 Dec 2021 17:48:05 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-d1ucGhWu9MJly3x8gEGyVw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0B6A 0
28 B 61ms
61ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BKHUW1O-wYeD4FOSS7_UPpYm9mAkAAAAAOAHgBAI&bg=!tLelt_PNAAaQHwIOkB87ACkAdvg8WtiLHZiaYrecodzuwZLL1L5xtxwTGAuEazc7rJDL8SnExIsuGgIAAAJGUgAAAA1oAQcKANDlHqoP7hbLDqhrYgnFCfau9gF5z1vUEQjFymme4nXikfGGQNDkTYO2uBU0JsXm6UZ5CAoXO3SQSMfx5IX2H_J0xXlX5NTMAtS05Y_iYrrKNGKquMEmILpiyX1MCGzTat5KUNpK0GMJa4jUwFSswhs7XOu3BtGXPfPLye4m7vKn5EzYIfL3mzjyzVzxRcxCrXYOYc1kEkmLhEHHKwfQ3pQ5vrNugnFw3HE0Rau3U-nDXVE4cHrD13ewn05dlQ7LICdsWSV4PCVHcQoxMaXvqLUvmQKxJrgto6gwJHDDAXLiHPqrs5CmNX41VmNkLXXyCSNm6OkpGSpRMXwlOMSulYQQKZfFYqQ1hUKZIW-Ma3pKdThinQy5f8zS-iUnGttS8NILQREjvZxlGZnRNYZaQq6RRcjuubSbn1mw3mWeel253VktdejPtH--v55GYOOW-51fByZWqWFmuzHMeSoWh-0xk5ra8dgQrkRSt-L_etpqTUV5Mc5ozrNEVfkUf8qYr-Y7WmrH0DZPWijpohmn9K5qjoc2ffM63hxToYYs6KkPHhO2ACpxRMsmlBzAjBK0h-f9vF3xQ5nuxOrF5blOa6RVlQRHQVU_rUt3GNMPocpqwLGSyC3kHn-jFvq30o4j9uez_4e1nY3B78iC3X4Gi27UNOw5qr76aaK-ZZtNsLMfvPkUK58_Gx1DzDVc3bCJry1hyldyF8IKh-M88PK2fbQJ9Qg6dOczb-Y3U18Zi5jjlzRK7CywLVYLQAWHTy7d92xX9S4Lmji67Uog5d9Y7mz1f31B7nMYxcJvMCiY5NihLyZPcQsFkrNNqft7oT4T_kS69ry9Tn9xJ_v3LaH4nr_XIBPyVuFWc1YtuH61aF2w-EUp1oTLWfHq44bMtex9zx9JC-tctQfH_f2Xq-KmGKc3oHkFFsYG3sg3wn_VmTOxIjtVm9R9doNpclZOmqGQ-Xmh1mtB7xrBpPjXdSNLM3rDNy8pGCF_ehcDeewUCwrvtoGbDXHWJmZ0RoTbudgq6lXfN7DloySZhStik8covSDvgyFKPALdqNPv7X1C7BXAFaB-wyg0k1XDp4tur1czeWOHEsAe0-lCtavar2gWgcCFGDTCwJCIDNZyJcE8i1_uGOsn6awg2kAOXAANHqggbrFPJ-mwD9ZXBp6v6J0BCet9jXMFEyoc4ezwRZoQ1rIxRPcyKts

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8872 0
28 B 61ms
60ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BJ9RG1O-wYdrdFP_D7_UP9rut0AsAAAAAOAHgBAI&bg=!e3ileDzNAAaQHwIOkB87ACkAdvg8WrNtMRN_8nTytGy6YVV29yqZvjqlX8YirYMuWr_mA1tJkDAgtAIAAAJfUgAAAA1oAQeZAqXo121dK2DxroyYhN0O1PQ7yuvoI2c2UFscwvddBUMOb0hAe2XsiP35BTgLF0cjr6F2lhuDi10pQILiTIPGdxaU8peuubmpJmoOB0Xvn695737x5Y8Kon_ZY04C0iBe-1uj-Z7SPLHlSBsnZmCuVdhBPdqbB_K4liN0AZ2JBDvN149B6ilYsZcisxFSNCqJ7uZP5l_cjsLQBFRMnkEaiCHr6fNEKaeI_DmpTOrpxhVBjNrfqGAAMV8ivhF7P9gaGnerewYl51-LxuexiqEAy3BqLGPAB-ZApTa2ozl-HzvA6ShfZXHER1abuS5btXT-nH-Inu1ZttNxFlfiPdfHJIS2zVRkWSTJV39lmhgyqVfnDh7rIezJKqinYkmzGbR2Aw55aJADFrlnr3LSC_rLucjdiO00XldcD_vPaJYADH1Pe9RTntLxkSO-GlArVmhP1WXaoHRHkJDhmFJhR9zBtaDSPQcf-rXl--aG3fsIA28yPxqOIXU0WBFcqhZRX5VhYiTOiAHQnzB1b-J7WD8noQVJhpBvG01MIKO6_iWv4gNXPi6EhVYhFj5KsTBKTyb70X3jHRUVr_M-0YbvT3nIXfmi1wlHqW3VQ6dg6vuILGvnsWNMeQNh2LTMz5xizTOISIai2FOnXwaPsGVEduY13xtfMIKAQLKgJeN5gQVNk9NEUNQ49OrztWm9697RFPbs_7KdB7OEqDO6t2BB2VkpJfzhZ1t1Wpu-oyFJ1mlIfjHq4hEifSNU1IFRaAzLOx8dv_gq6FnBm3aFUbJLduKg9Dh57_Leu0oCb7S1pIuD2SzFrCBH1ZXR7JC-6iTmvil8AOzhOwNj1t6oc21ATYXmkvpcOMYmI3zymKCF8Ir-Y6LnkYblDS_XSbeyMzqWCzTjIxHqTs9xPQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0BC5 0
0 80ms
80ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20211206&jk=856421656702612&rc=05ABBMTcMKM1frdMCt1Hdq0Lct1wQgfb-HIS7Z63q6pQ4hQzfjqv-0SUM-Q1q5sJUfLcljFQIDqXyAQZwcM6jJt7Gu9XHKirtsQVXtnVwLzCc3fYw-BIXoRTtySmrLrI9SMhSESDO8NX5HvLaiNIlV7-XXePpxEHS8MvVlD1FuzupZdwj9r8GQNPAYE44zmvHlYdnLYAQMon_x0VhqZ9yhZSjM8F-9JxgS8-QwJFhaQBk6WpLieaYCdGsXDOdxZPYnpIYHHZMY
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js Show response
pagead2.googlesyndication.com/bg/ Frame 6269 35 KB
13 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969b16dbf7df3d84d9f2b6498dbd14531a8de0cb889e0532a9d1fd3f1f3c46b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 17:06:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2490
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13349
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 17:06:35 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
28 B 63ms
63ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20211206&jk=856421656702612&bg=!mZqlmt7NAAaQHwIOkB87ACkAdvg8Wl38kdcWRa_upQrKR897R2EiWnoRyUIrEMKAVAhetMU0pPK_bwIAAABPUgAAAAhoAQeZAoGCjZVyNubuSF5B2ZmV-rV8jzytb2A4FIJ0nggAwJ0IK3hVQlL7rhoQtPvo39J-CCVqK6DjMemcB5ug0KSmA22E-fU_7XEzD0lKd99vA2nJwH9N7mMOrIDTBMzgz1mhuBHYrgLFVHiIV-kr9IDAFwHnwtgLPzOzoFgQh5fLdi1CiinWWCbM0DA1-StLxOSpcucrtDyow_TxOh0tfObOu38oPhd31CkgDJ2cLh2Zr8SQ8pZxg_2fiT3O56RaDqHAp6GJELDoenDedKaoxJitoshqYlGKh33CXCVSGx0ugM9jynf9FAXnM4yb9h_N1dqlLopBilHMA2CQbwboA_Yw1-igMCneBrE9dAM5wWXgURnGdt3kA4qwzTZrNZgU1lj4Z2kbf462VKcZJnHuTgdkISSIQUDnsgls0rHSjoeE454gxsqVGhV5Cu_WO57QVgiqLOD3QS1AvibNTovS5n7f93WUtrjY9dDjA_FxAazdHB2X9H7OtQZKgPU6m1QdY2hAlCS1ovQjcpC5PfnN1Rz9TNIxe_xHHtGWTt7CkMJ0ejJlat2tKU-PZoAWeXWiTJ09-IRMq04oCAoXepRyWr9SYDANn6v05f37lg7I4TM0Wb14i0FaVv5cqS9soFdfoXbd_k32tFGdTLsR63FDC0DCqQ3-lwpXlqrUk64Csk_ZYSful5fW2o2LQm6EtGRxSVhq___KLyEKo4twrXft-ofMVdWIuTcu8AvSjaN0H_fW1c7khFZxa7ySH5ZmyRUOsVXtRzX_lr5sFmGI9cc_4OJhQ_4_cbCWoDOPZ-wT2yEQuNlFxWsK1eNzrKeSHFFqou_83rAhWpO59Qav5WSl68jKuumtSA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://beautyticks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Dec 2021 17:48:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame F820 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5faa66be904a3716d6355f422e5cdcdb33631a8e685102171437f1613952013f

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ad.atdmt.com
URL: https://ad.atdmt.com/i/img;adv=11122207570744;ec=11122226302456;adv.a=6266241;c.a=25084125;s.a=3213511;p.a=288877889;a.a=482642580;cache=3503233461;

Domain: ad.atdmt.com
URL: https://ad.atdmt.com/i/img;adv=11122207570744;ec=11122226302456;adv.a=6266241;c.a=25084125;s.a=3213511;p.a=288877889;a.a=482642580;cache=4228277601;

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM

Verdicts & Comments Add Verdict or Comment

77 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

32 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-20 03:35:37	Name: _GRECAPTCHA Value: 09ABBMTcM4EVHJDNakdT8n5LC7-WTxR_NmnCa3wz-eE10a4aZO2527p6S_Q5Z-CFvZaC0sK09BmVpWFvpamuDujns
.beautyticks.com/	1970-01-20 16:47:37	Name: _ga Value: GA1.2.1468423062.1638985683
.beautyticks.com/	1970-01-19 23:17:52	Name: _gid Value: GA1.2.1789276782.1638985683
.beautyticks.com/	1970-01-19 23:16:25	Name: _gat_gtag_UA_165678669_1 Value: 1
.beautyticks.com/	1970-01-20 08:38:01	Name: __gads Value: ID=8b02590a958f72cf-222965a94bcc0086:T=1638985682:RT=1638985682:S=ALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw
.doubleclick.net/	1970-01-19 23:16:29	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-20 08:38:01	Name: IDE Value: AHWqTUnhTWr9ZAyFiluO52GTG2YLaOwmu7t4tKM-xCeUMSg2t5c1ks6qfjmJQE3RsBw
.casalemedia.com/	1970-01-20 01:26:01	Name: CMPS Value: 302
.casalemedia.com/	1970-01-20 08:02:01	Name: CMID Value: YbDv1K6GtmvEeL-N6tKSUQAA
.adnxs.com/	1970-01-20 01:26:01	Name: uuid2 Value: 1685168359327644995
.adnxs.com/	1970-01-20 01:26:01	Name: anj Value: dTM7k!M41.D>6NRF']wIg2GTtN/A')!@wnfH8K6pQK`!5=E<L5?%K>`Fd)saE_W-.E4<8jR$LDZsyY6AU'D$dsFp!%nugO%v4VB%nm0($<nn
.casalemedia.com/	1970-01-20 01:26:01	Name: CMPRO Value: 338
.casalemedia.com/	1970-01-19 23:17:52	Name: CMST Value: YbDv1GGw79QA
.rlcdn.com/	1970-01-20 08:02:01	Name: rlas3 Value: mjCUX/e5LqAuEPGIhebcQQzJ0g1P+SXX5iMwydFL3s4=
.casalemedia.com/	1970-01-20 08:02:01	Name: CMRUM3 Value: 2d61b0efd42760CAESEMlq2tUU52ike68RV9VVM-g
.quantserve.com/	1970-01-20 01:26:01	Name: d Value: EEgBCQH0JIEA
.quantserve.com/	1970-01-20 08:46:40	Name: mc Value: 61b0efd4-c37d4-b9268-98210
.agkn.com/	1970-01-20 08:02:01	Name: ab Value: 0001%3A1RqkwLMkUX6E1cndWRMOVKgqpyY38SO2
.agkn.com/	1970-01-20 08:02:01	Name: u Value: C\|0CEApQ6xUKUOsVAAAAAAAAQ13AQCAAQpAAAAAAA
.rlcdn.com/	1970-01-20 00:42:49	Name: pxrc Value: CNTfw40GEgUI6AcQABIGCOndKhAA
.pubmatic.com/	1970-01-19 23:17:52	Name: KTPCACOOKIE Value: YES
.pubmatic.com/	1970-01-20 01:26:01	Name: KADUSERCOOKIE Value: 3859D88C-5B3F-4EE2-9BC1-53CBC790470F
.e.dlx.addthis.com/	1970-01-20 08:46:40	Name: na_tc Value: Y
.hit.gemius.pl/	1970-01-20 08:45:13	Name: Gtest Value: KlxkIMGGQMGGkQKleeuZxDiissGMXP8cXRbG
.addthis.com/	1970-01-20 08:46:40	Name: na_tc Value: Y
.dlx.addthis.com/	1970-01-19 23:59:37	Name: na_rn Value: 0
.dlx.addthis.com/	1970-01-19 23:59:37	Name: na_sr Value: 20211208
.dlx.addthis.com/	1970-01-19 23:16:25	Name: na_srp Value: 3614
.dlx.addthis.com/	1970-01-19 23:59:37	Name: na_sc_e Value: 0
.addthis.com/	1970-01-20 08:46:40	Name: na_id Value: 2021120817480500048079846174
.addthis.com/	1970-01-20 08:46:40	Name: uid Value: 61b0efd5ff5a5fe3
.addthis.com/	1970-01-20 08:46:40	Name: ouid Value: 61b0efd500015628022be92f122d5ed0f08210e9af0b77ea3e23

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3288300619&adf=1514954413&pi=t.aa~a.1192212056~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250&nras=4&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=2141&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=BJloijK7qg&p=https%3A//beautyticks.com&dtd=74 Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/14967257856070586351/index.html".
security	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=250&adk=3288300619&adf=1514954413&pi=t.aa~a.1192212056~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=310x250&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=-M&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250&nras=4&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1060&ady=2141&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=BJloijK7qg&p=https%3A//beautyticks.com&dtd=74 Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/14967257856070586351/index.html".
security	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=100&adk=3376572913&adf=109231892&pi=t.aa~a.2172648555~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x100&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=1&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250%2C390x280&nras=6&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=2826&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=yA85TodoMR&p=https%3A//beautyticks.com&dtd=82 Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/11839137306054191879/index.html".
security	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8689467372974181&output=html&h=100&adk=3376572913&adf=109231892&pi=t.aa~a.2172648555~rp.1&w=390&fwrn=4&fwrnh=100&lmt=1638985683&rafmt=1&to=qs&pwprc=6225276054&psa=0&format=390x100&url=https%3A%2F%2Fbeautyticks.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638985683771&bpp=1&bdt=1199&idt=1&shv=r20211206&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D8b02590a958f72cf-222965a94bcc0086%3AT%3D1638985682%3ART%3D1638985682%3AS%3DALNI_MZcydJcY1LoHtXTzwX2JlEsAz-DCw&prev_fmts=0x0%2C390x280%2C310x250%2C310x250%2C390x280&nras=6&correlator=4409203597798&frm=20&pv=1&ga_vid=1468423062.1638985683&ga_sid=1638985683&ga_hid=1835361440&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=2826&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=856421656702612&pem=518&tmod=282658613&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=yA85TodoMR&p=https%3A//beautyticks.com&dtd=82 Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/11839137306054191879/index.html".
other	warning	URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11839137306054191879/index.html#t=16920599435686006407&p=https%3A%2F%2Fgoogleads.g.doubleclick.net Message: <link rel=preload> has an invalid `href` value
network	error	URL: https://ad.atdmt.com/i/img;adv=11122207570744;ec=11122226302456;adv.a=6266241;c.a=25084125;s.a=3213511;p.a=288877889;a.a=482642580;cache=4228277601; Message: Failed to load resource: net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin
network	error	URL: https://ad.atdmt.com/i/img;adv=11122207570744;ec=11122226302456;adv.a=6266241;c.a=25084125;s.a=3213511;p.a=288877889;a.a=482642580;cache=3503233461; Message: Failed to load resource: net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_cver=1&google_gid=CAESEJ_xzxmQDc-80YEYK8ajsEY&google_push=AYg5qPJA6c9ynQhkguBb8Mk3QGl7ye_uezmkrbK77cxVJdk0rRpnqRy9SmPfHxEc83VL1GZ2KiDl4Cd_1InBGOgD5fjzY6Z8GoYM Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YbDv1K6GtmvEeL_N6tKSUQAAAVIAAAAB&google_push=AYg5qPI5riDxkQSlHhzLN5qhJvL7nFOKU2SmHbUD3LyV07y5Lzr8NS8iaDK--itq395BYHItpAzK1c5McMe9DWVNZtxNMaUnaf8rbA&google_gid=CAESEFNH06JGQ2Lt4BYyNDA1x2w&google_cver=1 Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.atdmt.com
adservice.google.com
adservice.google.it
beautyticks.com
cm.g.doubleclick.net
cms.quantserve.com
d.agkn.com
dsum-sec.casalemedia.com
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
ib.adnxs.com
id.rlcdn.com
image6.pubmatic.com
odr.mookie1.com
p4-cgv6kkqr6uh6u-cl75vtzxg6lyfpex-if-v6exp3-v4.metric.gstatic.com
p4-fizjzs4y3yr6o-keiw7ypl5hgh7a52-if-v6exp3-v4.metric.gstatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
pixel.wp.com
rtb.openx.net
s0.2mdn.net
stats.wp.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
ad.atdmt.com
cm.g.doubleclick.net
104.111.215.191
142.250.181.227
142.250.184.194
142.250.185.195
142.250.185.66
172.217.18.98
18.196.159.27
185.33.221.88
185.64.190.78
192.0.76.3
2.18.234.21
217.182.200.19
2620:116:800d:21:5a23:9c4e:e774:96c1
2a00:1450:4001:801::2001
2a00:1450:4001:802::2003
2a00:1450:4001:803::2002
2a00:1450:4001:803::2003
2a00:1450:4001:810::2004
2a00:1450:4001:813::2002
2a00:1450:4001:829::200e
2a00:1450:4001:82a::2006
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::200a
2a00:1450:4001:830::2008
34.98.67.61
35.186.253.211
35.244.174.68
52.18.11.109
65.21.78.116
8.39.36.141
000f368e166bff7134f2c0ff890f75cd706b90c0de1a9a0be5d0c6f464d8c13e
0157d11106d6b70289099fd1ce1f7bea3a9dfbb46cee3994edb07ce765bb92fc
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
04903a826114bcc047b38127ec4af079e6967f1ea4d44e6bd7158f24f954535f
063d8985f8245469e0ef35d725dd72afc824bc022a766b3cfafd66952b0a25ce
06580faeade620264f91c139f7b4089f147197006169c9a9fcb06dd9c1406d7d
073840357f79938256118053474b7331a023ae709b009cdf319301a67c43bb56
0906e1c88d296ae43c2ac5e213e7fd5bb474ff13ad15d3e9c61338a0de9dfe24
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bd46f36ba2ec7f825283c462563bdeab33d927d46b94b03cc8f6349ae589f45
0bfa9b1629f8060bbddfae32fbd6dfd8b9b18c0d39ef5041b4ea12469712fff8
0c8dbd16ed52c5a11fe7116329ea9a70393e72ad59a856a98814e15a51bdfdae
0d5fe8f39f2e929e3f5dc82ae1a85fc478b21d87988430fe0a663f5426947a9c
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1285896d3c74e1596bd7f389c1183323d5d13109430f1427c47346591bae9e94
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
19a9b17ef063ede8dcc95a2bde8a6a81ea539d3ee96c9d3d31d86c0357ae47dc
1aaf4c318c2bf3c8877eea6fa5edf9ccb51344b19aff310e4d1a488f3f58f6a3
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1c3ff119553175f2cf19f85d9d1b72f552a0aa742363148bc2e75387cf579b5d
222db01a050a707c43dd69b0e321cf5c8839ab56cea8032054cf082429a6693c
255baadf76fe64f37128b8cb709186a0f52109944a3e05e018d8feb51e01485c
27f5a942212097396bcba5de0bb2b4be709098b1cd8ce8e30e7c785166b7789d
28277814cf8060f9fe40684129799beca6dc209f3b04c72ccde70b93c6c5c15b
293913879d30bab7499013e935009f5183facbddd63bfc9656a859622590b80b
2ab780a46819e537adac4580247dc093275aef9b87f2a924cbc06a226e62754a
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b32be0979cb9f2119bd22563ed89560525c15a8edfd6e662a1968314783f689
2da3cec06fc8ccae40077ed49d5eb86f550a110d914ee611611ba688f0fd610c
2da4f788289b5237b7398c2e9e3bf4ce88b135b4103a972b1a55383b2644b166
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
30d4eaccf2cb8cdd912abae65645fa1e3e56c3a7e4d5f86349b93a859f6f9665
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
3ae1f9d3bccf44ad0a7c8276c4e321fbac9a9a80202ff91807531b5a6162c417
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3f01ce846de825565cf6f7ccfbd14fc54758cb8a0a05944f8762e48f5cf0d199
41b60d2262cffca90f6cd644983a2d813336dc959558bdd6ae54b35ef06dd9fb
448e21a77621fdfcdc1562da7cde90266ab2ee84c1669ae6c322ceae60310dab
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4cb82f16c2339cf8eae51d1b09f12ed1c0e7a9d89d9ee40ab04c754b8131dbb6
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
509bf9e83d3ca5add614196c02c8e0ce59731d3d1a10552c944b74d86019d866
53f829ae556bf7011727483015d83a98bcdb4b5796eecb728827c1282c971536
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57c4a3c357741e9cbe4f96cb3756903d6b49615d620ccffbcf474b0add8966d9
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5a9832e8fbf9271704a38054b70a3623cc10a16404d01d23133ea1708c470f28
5b84335d42b38d3122349f53b20dd6a5cb0f45d1e45e5683fd572bcdda8c04a2
5bdc02ff4bf42419c115794478d5ac595e8ebda5501367516c59eeafb3c654eb
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5cb3856955a3ac59ae634eb7e8dad9290ab10e3cbdef65164b895e107b524da3
5cc6db800aa7e986fd076fff9836a3bca9a627b4c9d6431584b6d18ab7b5960b
5cfff9fb75787c224e95cd3a90817961c33dcb18e859cb3d8353d7ce0516e4f7
5ef79c6b8a7681a21274798950b8e72bcbd5c73e1f0248f33da5c83d2e841ed5
5faa66be904a3716d6355f422e5cdcdb33631a8e685102171437f1613952013f
6148d316fbd7ab6cb723e5beea0395bff6dbbd8cf60f541babb07947895bcda1
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62a17bc7232cf7af5c41ff98ec5a59d300d586773b5850e460aea5387f60c8b2
64e6c847b43f135af65a335bdf981f8729399643a1b790bf492226f5db1a5b0e
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c693f1bfd009b9ae853e1cf602e031862b1c7aa05e50fdb48c916ff55b3118a
72bb08ae4b593383918aa40dbf98fe8cc4d946dce9b2fdbf7bb6e58fe382f862
759423d45d67bb8220a1a2b75439a21b0f2a1852b158e38d3e375afa9f6923d7
776b8865c56e24e7e18df37764348238e078750c462f21c985a98c55e3b039a7
78a24a370ca388d2a349ee51a39f64c2eaad33e8c49e74238d30d6c25ac24426
7c6b5ac3afbbd8e5471899142a07880155a22391e9f40f031773447e86d46e18
7cba571f7afecf1731afb7be93831b349af7dd12e87a33818b2bcd1de82e86a2
807af920f70fe3546a49b5803a3ff6dabaf4ff9de7755bc493ff6c98492676f6
820e169ce24824066d9973fd4b6561aae9dcd6dbef6435da905d5a1d6482997c
82b532b885ebdddfe95c311d9125d3d085dcb8ce9df20a56bf741693904a78a4
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
830afbea215ec452ea905a7e4705cf3ea2bad82c2278f755791d85be2d5e2eb1
853bc22314880268a561a0ac05d0bbe28e62b13bcda2a6fbd632b71fe4827857
860a2d1e52b3c209d9e566a7962296196eb7800255520c48f88ed898c19e5549
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
890ccf25958f71ece3221ae1b3b9954ef17ff78f00aa20ed3d5fe83d04dd0875
8994924c0f3ab4474ee0a7c04417ad84933c4467cc9192fcb60b9774f15f5990
8aed12b8b95a1d49011f3e134dc8e71804a3576818d1d1334145aaa96d71aa5e
8ef7c48a57b4bf2ac39e22b4a4ca973c9bc6e90f35499f2b39ffcac86c0dedce
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
934a56c9bbf7d0a09dc29bb88ebe1734b36d77d41996fbb0653ea84eb5496b49
963c8078bf539ed77cedb3069b1c40cabd089543c09b429b7007fc06cbeac978
969b16dbf7df3d84d9f2b6498dbd14531a8de0cb889e0532a9d1fd3f1f3c46b7
989319465c2fd25d9cc7d6583581b3f7dbf2ac1d251cfbec2ab2cac4b42d533d
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
9dea96a664844dd84dd4e2b6b22cd64ff379b9389e7499db8f3491e4892938eb
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
aeb5c1cfe639ecc74723d7628bc75d6db0c59448fc556fd3f0bc4ea2ac88d05e
b138f0b28fe44581bebb03d0ff7046e4f8416deeb5d152ede640eaa3dc1c7872
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
b5f71c8c69f6c82cdd6445f6b0d9ffb2d079c8be0d4db711628d734bed811222
b67d71fb92839c0cc9c4380be72cc943f99039f7c0766bbbc0a552d9d6a1370f
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c41a2ab320e3ed0711d262941fc8b4202d4825f55bbdb157a98b3c96f24f54d0
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cd429ca4b699add93c19c2731a22a489a5a5d6d1d01445d337f8c89c8ca6eb2f
cde426d62acafe0e85b94e93258d95e690c487641a6b3213c0a7603d68a1b4fe
d0ba7e2275cddbdf3d2473a60565d950efb8474ba7bda393cc64f56ff39d85ce
d390c3643d82a2838c602d43b72487998c4967ed8b031576b9034283049dd3c3
d4155dd8184947f5b6cc19c91d2c70489e9d0ff63a53aeab46bdcaabf6d02c1b
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d853164105815c3ea423a95f095ee531f547ff1e12fba56a80be0f712c62929e
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
df2b5282f28c9151bac3d100df49ed5e7f94daa4eb2229f203d02e559bd57a47
e31aa7d2c0d11267d6e4513e11849566e572e355fc6d14982f9affa7093e87b3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4b97dcc4e5265d3d2e8a74ea6490302e40cd9977430c9d9bcc02c1c241a46d2
e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181
e529245e8867300ffd2b6f6c1e5b36d41ce8c71a9eb7cbdec52360c0be7b0017
e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770
e87a1c5e24f9a7c7dcb437417f0b05b0a3c12947ce32d65c990c988a8b5ed4d7
ea37b726a887afb5fc602e41e00d785142ad4db5f257009f4440d47850660445
eae170b97d752c817a4d707ab6ad73aeff7ca3d1f98f39b22f4ae40570101fa7
eaef3ed4c6c553c79ef768c9548b2fd82074f9dcdd1ddd2f89a6422291c4ff34
edf223f145e0fd4b472d360947a832ac233dd950919298ae1c518776ff71e00c
ef125e2c4198517761319d28b80173b5dc1357fb3076fbdcc6a21868c913b9e2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1705ddc5eaff21e32e90d904b8a188e7c3979eece891e28416f7246fd3b2f51
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f731b6f1d0931b5db76cee766b055f1068b91d807a606812ff1f3150c25fd9ab
f77f54ef179b3954e26d7d5f9a2328e62c3930070c876edb89c1d84738b47b17
f9f94cc2cf984a2a8df89c1250c04396bc950e577b4143d5539ca88fb46de91b
fab1350afa3d34e46c174b572091f61bd4359524f16a3530621194c35c27bfe9

beautyticks.com Open in urlscan Pro 65.21.78.116 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

232 Requests

90 %HTTPS

42 %IPv6

26 Domains

34 Subdomains

27 IPs

7 Countries

2640 kBTransfer

6398 kBSize

32 Cookies

1 Outgoing links

Redirected requests

232 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

beautyticks.com Open in urlscan Pro
65.21.78.116 Public Scan

Screenshot
Live screenshot

Full Image

232
Requests

90 %
HTTPS

42 %
IPv6

26
Domains

34
Subdomains

27
IPs

7
Countries

2640 kB
Transfer

6398 kB
Size

32
Cookies

232 HTTP transactions
7 data transactions