ufile.io Open in urlscan Pro
2606:4700:21::681b:c358 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ufile.io/
Effective URL:
https://ufile.io/
Submission: On August 23 via manual (August 23rd 2021, 7:30:01 pm UTC) from IN

Summary HTTP 260 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 62 IPs in 10 countries across 49 domains to perform 260 HTTP transactions. The main IP is 2606:4700:21::681b:c358, located in United States and belongs to CLOUDFLARENET, US. The main domain is ufile.io.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 11th 2021. Valid for: a year.

This is the only time ufile.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 20	2606:4700:21:... 2606:4700:21::681b:c358	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba08	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2606:4700::68... 2606:4700::6810:5f41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
12	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
5 11	185.33.221.89 185.33.221.89	29990 (ASN-APPNEX) (ASN-APPNEX)
6	147.75.38.124 147.75.38.124	54825 (PACKET) (PACKET)
1	3.123.48.64 3.123.48.64	16509 (AMAZON-02) (AMAZON-02)
3	2606:4700:10:... 2606:4700:10::6816:37ce	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	67.202.110.24 67.202.110.24	32748 (STEADFAST) (STEADFAST)
1	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
6	2606:4700::68... 2606:4700::6812:1d5b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:812::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
19	2a00:1450:400... 2a00:1450:4001:800::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
20	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
2 4	2a00:1450:400... 2a00:1450:4001:812::2004	15169 (GOOGLE) (GOOGLE)
16 20	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
5 7	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
27	2a00:1450:400... 2a00:1450:4001:803::2006	15169 (GOOGLE) (GOOGLE)
6 8	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
4	104.111.242.245 104.111.242.245	16625 (AKAMAI-AS) (AKAMAI-AS)
8	46.4.10.49 46.4.10.49	24940 (HETZNER-AS) (HETZNER-AS)
2	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
1 4	138.201.84.252 138.201.84.252	24940 (HETZNER-AS) (HETZNER-AS)
1 4	176.9.26.250 176.9.26.250	24940 (HETZNER-AS) (HETZNER-AS)
4 8	104.111.239.217 104.111.239.217	16625 (AKAMAI-AS) (AKAMAI-AS)
3 6	108.128.25.216 108.128.25.216	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:219... 2600:9000:2190:3400:b:a286:7800:93a1	16509 (AMAZON-02) (AMAZON-02)
3	46.236.13.147 46.236.13.147	24931 (DEDIPOWER) (DEDIPOWER)
3	2600:9000:215... 2600:9000:2156:da00:1a:7c92:efc0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	13.224.102.88 13.224.102.88	16509 (AMAZON-02) (AMAZON-02)
1	81.29.72.47 81.29.72.47	24931 (DEDIPOWER) (DEDIPOWER)
2	54.75.239.54 54.75.239.54	16509 (AMAZON-02) (AMAZON-02)
1	2.18.232.130 2.18.232.130	16625 (AKAMAI-AS) (AKAMAI-AS)
1	208.100.17.173 208.100.17.173	32748 (STEADFAST) (STEADFAST)
2 7	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
2	2.18.233.180 2.18.233.180	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	216.52.2.30 216.52.2.30	30282 (AS-INAPCD...) (AS-INAPCDN-OCY)
2 2	18.197.99.6 18.197.99.6	16509 (AMAZON-02) (AMAZON-02)
3 3	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
2 13	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	185.64.189.115 185.64.189.115	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 3	13.248.242.197 13.248.242.197	16509 (AMAZON-02) (AMAZON-02)
1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
1 2	52.46.133.124 52.46.133.124	16509 (AMAZON-02) (AMAZON-02)
1 1	70.42.32.95 70.42.32.95	13789 (INTERNAP-...) (INTERNAP-BLK3)
3 4	37.157.3.29 37.157.3.29	198622 (ADFORM) (ADFORM)
2 2	213.155.156.167 213.155.156.167	1299 (TELIANET ...) (TELIANET Telia Carrier)
1	178.250.2.151 178.250.2.151	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 1	85.114.159.93 85.114.159.93	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
2 2	185.29.134.248 185.29.134.248	30419 (MEDIAMATH...) (MEDIAMATH-INC)
2	185.64.190.81 185.64.190.81	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	51.79.83.225 51.79.83.225	16276 (OVH) (OVH)
2 2	34.254.143.3 34.254.143.3	16509 (AMAZON-02) (AMAZON-02)
1	159.253.128.188 159.253.128.188	36351 (SOFTLAYER) (SOFTLAYER)
1 1	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
3 3	18.184.94.176 18.184.94.176	16509 (AMAZON-02) (AMAZON-02)
2 2	52.17.35.107 52.17.35.107	16509 (AMAZON-02) (AMAZON-02)
2 2	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
260	62

20 2606:4700:21::681b:c358 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

ufile.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00::210:ba08 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cdn.fuseplatform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:5f41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 185.33.221.89 (Amsterdam, Netherlands) 5 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 147.75.38.124 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.123.48.64 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-123-48-64.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:10::6816:37ce (United States)

ASN13335 (CLOUDFLARENET, US)

i.connectad.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.connectad.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync-eu.connectad.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 67.202.110.24 (Crown Point, United States)

ASN32748 (STEADFAST, US)
PTR: ip24.67-202-110.static.steadfastdns.net

ssc.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:1d5b (United States)

ASN13335 (CLOUDFLARENET, US)

client.crisp.chat	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:800::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:812::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 172.217.16.130 (United States) 16 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2.18.234.21 (Frankfurt am Main, Germany) 5 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 2a00:1450:4001:803::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 35.244.159.8 (Kansas City, United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.242.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 46.4.10.49 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.49.10.4.46.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.84.252 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.252.84.201.138.clients.your-server.de

hal900024.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 176.9.26.250 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.250.26.9.176.clients.your-server.de

hal900014.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.111.239.217 (Frankfurt am Main, Germany) 4 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-239-217.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.zenaps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 108.128.25.216 (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-108-128-25-216.eu-west-1.compute.amazonaws.com

ti.tradetracker.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:3400:b:a286:7800:93a1 (United States)

ASN16509 (AMAZON-02, US)

htlp.large.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 46.236.13.147 (United Kingdom)

ASN24931 (DEDIPOWER, GB)
PTR: 46-236-13-147.servers.dedipower.net

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2156:da00:1a:7c92:efc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.tradetracker.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.102.88 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-102-88.zrh50.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.29.72.47 (Epsom, United Kingdom)

ASN24931 (DEDIPOWER, GB)
PTR: 81-29-72-47.servers.dedipower.net

diapi.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.75.239.54 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-75-239-54.eu-west-1.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.232.130 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-130.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 208.100.17.173 (United States)

ASN32748 (STEADFAST, US)
PTR: ip173.208-100-17.static.steadfastdns.net

ssc-cms.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 76.223.111.18 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.233.180 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.52.2.30 (United States) 2 redirects

ASN30282 (AS-INAPCDN-OCY, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.197.99.6 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-99-6.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.126.56.137 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 185.64.190.80 (United Kingdom) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.115 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.248.242.197 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:110:c305::8000 (Dublin, Ireland) 1 redirects

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.46.133.124 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 70.42.32.95 (United States) 1 redirects

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.157.3.29 (Denmark) 3 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.155.156.167 (Uppsala, Sweden) 2 redirects

ASN1299 (TELIANET Telia Carrier, SE)
PTR: 213-155-156-167.teliacarrier-cust.com

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.2.151 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.114.159.93 (Schopfheim, Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.29.134.248 (United Kingdom) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.81 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.79.83.225 (Beauharnois, Canada) 1 redirects

ASN16276 (OVH, FR)
PTR: pikafka-5.cloudy.ovh

pixel.onaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.254.143.3 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-143-3.eu-west-1.compute.amazonaws.com

loada.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.253.128.188 (Amsterdam, Netherlands)

ASN36351 (SOFTLAYER, US)
PTR: bc.80.fd9f.ip4.static.sl-reverse.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:f916:5049:f87f:108e (United States) 1 redirects

ASN16509 (AMAZON-02, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.184.94.176 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-94-176.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.17.35.107 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-35-107.eu-west-1.compute.amazonaws.com

r.scoota.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
44	googlesyndication.com a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	218 KB
37	doubleclick.net 16 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net googleads4.g.doubleclick.net	227 KB
27	2mdn.net s0.2mdn.net	1 MB
20	ufile.io 1 redirects ufile.io	277 KB
19	pubmatic.com 2 redirects hbopenbid.pubmatic.com ads.pubmatic.com image2.pubmatic.com image6.pubmatic.com simage2.pubmatic.com image4.pubmatic.com	36 KB
16	redintelligence.net 2 redirects hal9000.redintelligence.net hal900024.redintelligence.net hal900014.redintelligence.net	332 KB
15	33across.com ssc.33across.com ssc-cms.33across.com	5 KB
12	adnxs.com 5 redirects ib.adnxs.com acdn.adnxs.com	25 KB
10	ampproject.org cdn.ampproject.org	203 KB
9	tradetracker.net 3 redirects ti.tradetracker.net static.tradetracker.net	36 KB
8	openx.net 6 redirects us-u.openx.net	2 KB
8	gstatic.com fonts.gstatic.com	147 KB
8	3lift.com 2 redirects tlx.3lift.com eb2.3lift.com	3 KB
7	casalemedia.com 5 redirects dsum-sec.casalemedia.com ssum.casalemedia.com	6 KB
7	google.com 2 redirects adservice.google.com www.google.com	858 B
6	crisp.chat client.crisp.chat	139 KB
6	a-mo.net prebid.a-mo.net	1 KB
5	yahoo.com 4 redirects ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	4 KB
4	adform.net 3 redirects c1.adform.net	2 KB
4	webgains.com track.webgains.com diapi.webgains.com	17 KB
4	zenaps.com www.zenaps.com	3 KB
4	awin1.com 4 redirects www.awin1.com	3 KB
4	teads.tv sync.teads.tv	688 B
4	googletagservices.com www.googletagservices.com	139 KB
4	googleapis.com fonts.googleapis.com	3 KB
3	bidswitch.net 3 redirects x.bidswitch.net	1 KB
3	adsrvr.org 2 redirects match.adsrvr.org	1 KB
3	webgains.io analytics.webgains.io api.webgains.io	61 KB
3	connectad.io i.connectad.io cdn.connectad.io sync-eu.connectad.io	1 KB
3	cloudflareinsights.com static.cloudflareinsights.com cloudflareinsights.com	5 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	742 B
2	scoota.co 2 redirects r.scoota.co	1 KB
2	exelator.com 2 redirects loada.exelator.com	2 KB
2	onaudience.com 1 redirects pixel.onaudience.com	736 B
2	mathtag.com 2 redirects sync.mathtag.com	1 KB
2	de17a.com 2 redirects d5p.de17a.com	637 B
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com	703 B
2	advertising.com 2 redirects pixel.advertising.com	735 B
2	lijit.com 2 redirects ap.lijit.com	1 KB
2	google.nl adservice.google.nl	975 B
2	google-analytics.com www.google-analytics.com	19 KB
2	fuseplatform.net cdn.fuseplatform.net	82 KB
1	quantserve.com 1 redirects pixel.quantserve.com	542 B
1	simpli.fi um.simpli.fi	609 B
1	adition.com 1 redirects dsp.adfarm1.adition.com	501 B
1	criteo.com dis.criteo.com	360 B
1	zemanta.com 1 redirects b1sync.zemanta.com	301 B
1	bing.com c.bing.com	422 B
1	large.nl htlp.large.nl	3 KB
260	49

	Domain	Requested by
27	s0.2mdn.net	ufile.io s0.2mdn.net a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
22	tpc.googlesyndication.com	ufile.io securepubads.g.doubleclick.net a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com cdn.ampproject.org googleads.g.doubleclick.net tpc.googlesyndication.com
20	cm.g.doubleclick.net	16 redirects googleads.g.doubleclick.net eb2.3lift.com
20	ufile.io	1 redirects ufile.io
18	pagead2.googlesyndication.com	securepubads.g.doubleclick.net a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com
14	ssc.33across.com	cdn.fuseplatform.net
11	ib.adnxs.com	5 redirects cdn.fuseplatform.net googleads.g.doubleclick.net acdn.adnxs.com eb2.3lift.com
10	cdn.ampproject.org	securepubads.g.doubleclick.net
8	hal9000.redintelligence.net	a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com hal900024.redintelligence.net hal900014.redintelligence.net
8	us-u.openx.net	6 redirects googleads.g.doubleclick.net
8	googleads.g.doubleclick.net	a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com ufile.io
8	fonts.gstatic.com	fonts.googleapis.com
7	image2.pubmatic.com	2 redirects ads.pubmatic.com
7	eb2.3lift.com	2 redirects cdn.fuseplatform.net eb2.3lift.com
6	simage2.pubmatic.com	ads.pubmatic.com
6	ti.tradetracker.net	3 redirects ufile.io hal900014.redintelligence.net
6	client.crisp.chat	ufile.io client.crisp.chat
6	prebid.a-mo.net	cdn.fuseplatform.net
6	securepubads.g.doubleclick.net	cdn.fuseplatform.net securepubads.g.doubleclick.net ufile.io
5	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
5	www.google.com	2 redirects ufile.io a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com tpc.googlesyndication.com
4	c1.adform.net	3 redirects ads.pubmatic.com
4	www.zenaps.com	hal900024.redintelligence.net a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com hal900014.redintelligence.net
4	www.awin1.com	4 redirects
4	hal900014.redintelligence.net	1 redirects a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com hal900014.redintelligence.net
4	hal900024.redintelligence.net	1 redirects a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com hal900024.redintelligence.net
4	sync.teads.tv	googleads.g.doubleclick.net
4	www.googletagservices.com	securepubads.g.doubleclick.net a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
4	fonts.googleapis.com	securepubads.g.doubleclick.net hal900024.redintelligence.net hal900014.redintelligence.net
4	a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	x.bidswitch.net	3 redirects
3	match.adsrvr.org	2 redirects eb2.3lift.com
3	ups.analytics.yahoo.com	3 redirects
3	static.tradetracker.net	a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com hal900014.redintelligence.net
3	track.webgains.com	ufile.io a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com analytics.webgains.io
2	sync-tm.everesttech.net	2 redirects
2	r.scoota.co	2 redirects
2	loada.exelator.com	2 redirects
2	pixel.onaudience.com	1 redirects ads.pubmatic.com
2	image4.pubmatic.com	ads.pubmatic.com
2	sync.mathtag.com	2 redirects
2	d5p.de17a.com	2 redirects
2	s.amazon-adsystem.com	1 redirects eb2.3lift.com
2	pr-bh.ybp.yahoo.com	1 redirects ads.pubmatic.com
2	ssum.casalemedia.com	2 redirects
2	pixel.advertising.com	2 redirects
2	ap.lijit.com	2 redirects
2	ads.pubmatic.com	cdn.fuseplatform.net ads.pubmatic.com
2	api.webgains.io	analytics.webgains.io
2	googleads4.g.doubleclick.net	ufile.io
2	cloudflareinsights.com	static.cloudflareinsights.com
2	adservice.google.com	securepubads.g.doubleclick.net
2	adservice.google.nl	securepubads.g.doubleclick.net
2	www.google-analytics.com	ufile.io www.google-analytics.com
2	cdn.fuseplatform.net	ufile.io cdn.fuseplatform.net
1	pixel.quantserve.com	1 redirects
1	um.simpli.fi	ads.pubmatic.com
1	dsp.adfarm1.adition.com	1 redirects
1	dis.criteo.com	ads.pubmatic.com
1	b1sync.zemanta.com	1 redirects
1	c.bing.com	eb2.3lift.com
1	image6.pubmatic.com	ads.pubmatic.com
1	sync-eu.connectad.io	cdn.connectad.io
1	cdn.connectad.io	cdn.fuseplatform.net
1	ssc-cms.33across.com	cdn.fuseplatform.net
1	acdn.adnxs.com	cdn.fuseplatform.net
1	diapi.webgains.com	track.webgains.com
1	analytics.webgains.io	track.webgains.com
1	htlp.large.nl	hal900014.redintelligence.net
1	hbopenbid.pubmatic.com	cdn.fuseplatform.net
1	i.connectad.io	cdn.fuseplatform.net
1	tlx.3lift.com	cdn.fuseplatform.net
1	stats.g.doubleclick.net	www.google-analytics.com
1	static.cloudflareinsights.com	ufile.io
260	74

This site contains links to these domains. Also see Links.

Domain
help.ufile.io
status.ufile.io
www.ssllabs.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-11` - `2022-07-10`	a year	crt.sh
cdn.fuseplatform.net R3	`2021-06-03` - `2021-09-01`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.google.nl GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.a-mo.net R3	`2021-07-16` - `2021-10-14`	3 months	crt.sh
*.3lift.com Amazon	`2021-06-12` - `2022-07-11`	a year	crt.sh
connectad.io Cloudflare Inc ECC CA-3	`2021-05-16` - `2022-05-15`	a year	crt.sh
*.33across.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-01` - `2021-09-30`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2020-12-07` - `2021-12-14`	a year	crt.sh
crisp.chat Cloudflare Inc ECC CA-3	`2021-07-08` - `2022-07-07`	a year	crt.sh
misc-sni.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-07-26` - `2021-10-18`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
teads.tv R3	`2021-08-23` - `2021-11-21`	3 months	crt.sh
redintelligence.net R3	`2021-08-20` - `2021-11-18`	3 months	crt.sh
www.awin1.com DigiCert SHA2 Secure Server CA	`2021-06-11` - `2022-06-16`	a year	crt.sh
*.tradetracker.net Amazon	`2020-12-20` - `2022-01-18`	a year	crt.sh
htlp.large.nl Amazon	`2021-03-03` - `2022-04-01`	a year	crt.sh
*.webgains.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-20` - `2022-06-20`	a year	crt.sh
*.webgains.io Amazon	`2021-03-12` - `2022-04-10`	a year	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2021-03-11` - `2022-02-07`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2021-07-06` - `2022-01-06`	6 months	crt.sh
s.amazon-adsystem.com Amazon	`2021-07-14` - `2022-06-27`	a year	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-06-27` - `2021-09-24`	3 months	crt.sh
*.onaudience.com Certyfikat SSL	`2021-05-28` - `2022-05-28`	a year	crt.sh
*.simpli.fi DigiCert SHA2 Secure Server CA	`2019-09-18` - `2021-12-12`	2 years	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-03-29` - `2021-09-22`	6 months	crt.sh

This page contains 32 frames:

Primary Page: https://ufile.io/
Frame ID: 108F6699394871EAF0F8CEBA306A05FC
Requests: 69 HTTP requests in this frame

Frame: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 6F2895A6CEBAFACB4DCF7187E7D9A420
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012108100143000/amp4ads-v0.mjs
Frame ID: 5465321AE700B2293E3E2124A0037361
Requests: 17 HTTP requests in this frame

Frame: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: E8A301B4AC91B7BAFDA5D7C851FD09D8
Requests: 18 HTTP requests in this frame

Frame: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 78E83143CBD4BE6A52BDC1EECE37E23E
Requests: 14 HTTP requests in this frame

Frame: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 32C1188E5A8F524C6A4722E2B7A7BCB0
Requests: 13 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012108100143000/amp4ads-v0.mjs
Frame ID: E30ED0EA6E0D4ED48353AE325D23020A
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVT7Ms0o7A-aHsNpZhcaUyQTI712FHxV-c2zLHC_cgAeMWR1HphwCk4xvsDefmqA3pOgrAxaHtTS6kGIqfNdd4zEKWHzmbKUTLp6lcuEaJGQYAJ50Z0jJlIJTMZm4SNusqD3oP72TDMfmBIzQhrQgfPii6Ifqadd1wUOmuQ_5MzQhUeq0w
Frame ID: 13B09DB0207C462F3C0E5AACECF77D88
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVJz0Bk-qvwOR8bSce3HLv-ht9-p6IfYI1lPb2r3nQP1HvwDyxKRxJouHL7nssNy2x8HXWQNpUFUTwQfG1ov-M0D3DglfEs8YFy5qpsQsZcpKBofL5g7wnIbt6pOj8FP5fahEVytTEbo7mUrISDcrhb1bpH5YOIRhqFAkHcy3Eg2vVGOt4
Frame ID: 9DE4B4D327FEA2BDBD6DF130662897BE
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKSElwEQoKCcARjRtsywATAB&v=APEucNWz4zKlOZUTK151gVMrZHNPZELz9EcicBgzaz54nazEM1VaXD5xAJkv-AP7iGfK62nGzjiL-44sLBLFLLVQVPm1WG9GZp4bUIdcRRisYewc9zoPOM6unUQ02rOJq_ZUS5BxgmzjZ6WBxWnmfIO5cdl0iD3S10IKDYJMAliHxljWRVwnE_E
Frame ID: B96E9C26AA3ADA5B3764BBED2D72CA09
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: A7BE2F0656245D4DE5F302EFCD62ED6A
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 2836F2703C4E5BF2091324857006E6FE
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 34B8C618A867CB069D7F2621BC6F63D6
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 327E9EFF009DAD2160C739A5A09D30A6
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/8483882/1626446224307/index.html
Frame ID: 2791497653EE710F19DA5F3DDE5B5873
Requests: 26 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 61DD5F85CBB4A416C0BD4C255BFBE61A
Requests: 3 HTTP requests in this frame

Frame: https://www.zenaps.com/cshow.php?pvr=79bc9041-0448-11ec-a5ea-692d04ef6a29&v=8508&r=235229&q=413151&s=2882174&viewref=98116500199684200719604011695024&pv=1
Frame ID: F2249B12092A4C8F0263765AA20AD99E
Requests: 1 HTTP requests in this frame

Frame: https://www.zenaps.com/cshow.php?pvr=79bd7aa0-0448-11ec-9723-692d00a25ac2&v=9247&r=235229&q=407742&s=2824569&viewref=98116500199684200719604011695024&pv=1
Frame ID: BB13785A9BC980AE6396AF2A9154B12E
Requests: 1 HTTP requests in this frame

Frame: https://hal900024.redintelligence.net/request_content.php?s=98116500199684200719604011695024&a=0befc47b
Frame ID: 9074297D14E6E2A3D0962774F04A7257
Requests: 9 HTTP requests in this frame

Frame: https://htlp.large.nl/
Frame ID: 3DB9E46CBB0E09C8A54329E662E49B36
Requests: 1 HTTP requests in this frame

Frame: https://www.zenaps.com/cshow.php?pvr=79c96180-0448-11ec-9723-692d00a25ac2&v=19227&r=235229&q=409216&s=2841812&viewref=33897200160697300719604011695014&pv=1
Frame ID: 5CD38DBD398EEF30AAA73A7CD31B1899
Requests: 1 HTTP requests in this frame

Frame: https://hal900014.redintelligence.net/request_content.php?s=33897200160697300719604011695014&a=29bec7ee
Frame ID: 4D7EE01E86014610A77EBA049222136B
Requests: 11 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: DF6CCE372E500FA2D6228E951D4F9960
Requests: 3 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=aMwmEQ9far64kTaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined
Frame ID: 7A619FE526A3ED492E747B82109E8043
Requests: 1 HTTP requests in this frame

Frame: https://cdn.connectad.io/connectmyusers.php
Frame ID: D358EB3A3CF405B6BF4997516A3E3C74
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 7A70B4D992BF4D334B0F689C937F9753
Requests: 11 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 7D95BB4724CA7886439B79A1D4C5514F
Requests: 17 HTTP requests in this frame

Frame: https://sync-eu.connectad.io/syncer/1
Frame ID: F839F3864ED467E39D4D690A6B6DFBB4
Requests: 1 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=CE480BBC-F83B-48B4-A728-2E69C75EAB97
Frame ID: 7D3F148A0A8AAE927CA45FD31A94AC7E
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6726905464725056262
Frame ID: 303D7FC685A029B75A62ECAEBCB470BB
Requests: 1 HTTP requests in this frame

Frame: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Frame ID: 0C7ACD3C623B4C8C6818DD1AD3E8AD94
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6999710014239013007
Frame ID: 32EE057149E8E0DC5D66048BC50946F6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ufile.io - Upload files for free & share them without registration

Page URL History Show full URLs

http://ufile.io/ HTTP 301
https://ufile.io/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

260
Requests

100 %
HTTPS

40 %
IPv6

49
Domains

74
Subdomains

62
IPs

10
Countries

3251 kB
Transfer

6395 kB
Size

9
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://help.ufile.io/
Title: Help

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/category/api-1mxx513/
Title: API

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/article/what-file-types-can-i-upload-4zd8dp/
Title: Learn more about supported file types »

Search URL Search Domain Scan URL

URL: https://status.ufile.io/
Title: data centres

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/article/where-will-my-files-be-hosted-bbbklg/
Title: Learn more about our network »

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/article/how-do-i-upload-a-file-1ylo5km/
Title: Learn More »

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/article/what-speeds-can-i-expect-r1kqqr/
Title: Learn More »

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/article/is-there-a-limit-on-bandwidth-w3c39a/
Title: Learn More »

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/article/file-password-protection-1ghgufe/
Title: Learn More »

Search URL Search Domain Scan URL

URL: https://www.ssllabs.com/ssltest/analyze.html?d=ufile.io
Title: grade A

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/article/how-secure-is-uploadfiles-13ym5fl/
Title: Learn More »

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/article/embeddable-file-upload-widget-1arfle5/
Title: Learn More »

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/article/selling-files-on-uploadfiles-1y69mke/
Title: Learn More »

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/article/one-time-download-links-1y50wmp/
Title: Learn More »

Search URL Search Domain Scan URL

URL: https://help.ufile.io/en/article/how-to-enable-direct-downloads-1a3zr00/
Title: Learn More »

Search URL Search Domain Scan URL

URL: https://help.ufile.io/faq/
Title: Find more FAQs in our support portal »

Search URL Search Domain Scan URL

URL: http://status.ufile.io/
Title: Status

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ufile.io/ HTTP 301
https://ufile.io/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 97

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 113

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 120

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEjlnBi3046pnRoP2GiUx-Y&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEjlnBi3046pnRoP2GiUx-Y&google_cver=1&C=1

Request Chain 121

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YSP3Ku-t4Pxsht6O.eMWQwAA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm=&google_hm=YSP3Ku-t4Pxsht6O.eMWQwAA&google_tc= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPuCveD4KzqzKuhlJg1k9qQ&google_cver=1&google_hm=2

Request Chain 122

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEIccmybS4NEbxNPQG4Ubi9c&google_cver=1

Request Chain 123

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU2OTUxMTcxNjExMzYyNTU1Mg%3D%3D

Request Chain 129

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1

Request Chain 130

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmVmNDAzMzUtMGU0ZC0yMzNlLWM2ZjctNmEzZmUzOTVlYzkx HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmVmNDAzMzUtMGU0ZC0yMzNlLWM2ZjctNmEzZmUzOTVlYzkx&google_tc=

Request Chain 131

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESECUR0I-UZ0YH5o5u_gMfrSw&google_cver=1

Request Chain 133

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1

Request Chain 134

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Mzg2MDM0NjgtMzAwYi0yMmM1LWQxNTgtNmI3NWVmZTA5MmQ2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Mzg2MDM0NjgtMzAwYi0yMmM1LWQxNTgtNmI3NWVmZTA5MmQ2&google_tc=

Request Chain 135

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESECUR0I-UZ0YH5o5u_gMfrSw&google_cver=1

Request Chain 152

https://hal900024.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=c3b4c1f80a&subid=&uid=953a653ff5bce91d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAqnFKfcjYbGtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_Q6p7-TJlJDNl76TbL2kwKYTpmbx0XeEU87dKGjd3btHHnekbE6V2tXuD-t3KJ5oPm2TfcZmgraoYkBiG1evoHRD5nMreBX0Uh5O03nt9mXmaRE8rl9SArnWRvsLWnsxfbHIbhzFy_zvZyb94fV_uHTr1H6RXzAxJDu2TaKImhDAqf7dS9KdKYaXoGSquJTcWEJ5KQbQK0oDIPKrqsZTzMH4_xx5lhNkZeHGruJc3LuI_gH0vgktqtGb9wbcATmiVyC9paou6QxP9UwQ6w7r3jK-pDyT9wYjLABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoqtWErkNJFYL8abrXgoi8ZnfQ8Q%26sig%3DAOD64_0mG4Z30cBe7iWnjQ87MUNs02a4mQ%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-B4pcDUwBbK3t_448c2as49MMMS8rUeE1iJfYiOsTtQWlrXIUVfr449ZJrVaEDeeeqvsF0DP7oB6DF5V_I4VIOOxd83XNdRFv2G7zNuXVODiM5x88UxRADVuOthwY-JrFjZFFQ9Dv2fqT6x2N0ZlGAzyBVx-Q%26cry%3D1%26dbm_d%3DAKAmf-B9dvv_XJWopkRmopIsNufgam2SAMDKD3pw1GrEC4SELTOukb7ZfSBtFYUJE_K9BXxajoq9Dx4KsnondjtCqeqR5BSQ3CdVQoKbRHVLKuYaJDhJeYlJRjoUu7HGzMQ0qqOSJ6aOXpYZQZgSsHnZmWQB4v6lYZ66XsP4Rd3PS3fOMa_HmXqEOPCQjhT1dn1e_Ee6vS_92LzjZpnGz13VROSHSQov291AuPJUfF4Y0kP05yK6yiOgcOLE0ocfOVhr5GQUGpCI_6pPjOk_dVXGAG1nrg1LrdXLmY18QPrYjEPNpDR6Az_vYiDbClbjMNBHH3hyPcrr9J0QL7DtmQnA35xV4g4hecGGn8RpA7mPFUWRRV3FDPmA2Ue1GaN0SdxKZPR30bc07FqcfYtiiHkWIIoZ4cmVRFzM3cjAMbX0RV0_sbv3r4RFk-zj2XrIlr3-XPBO03Ki%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=1595731836652&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900024.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=c3b4c1f80a&subid=&uid=953a653ff5bce91d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAqnFKfcjYbGtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_Q6p7-TJlJDNl76TbL2kwKYTpmbx0XeEU87dKGjd3btHHnekbE6V2tXuD-t3KJ5oPm2TfcZmgraoYkBiG1evoHRD5nMreBX0Uh5O03nt9mXmaRE8rl9SArnWRvsLWnsxfbHIbhzFy_zvZyb94fV_uHTr1H6RXzAxJDu2TaKImhDAqf7dS9KdKYaXoGSquJTcWEJ5KQbQK0oDIPKrqsZTzMH4_xx5lhNkZeHGruJc3LuI_gH0vgktqtGb9wbcATmiVyC9paou6QxP9UwQ6w7r3jK-pDyT9wYjLABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoqtWErkNJFYL8abrXgoi8ZnfQ8Q%26sig%3DAOD64_0mG4Z30cBe7iWnjQ87MUNs02a4mQ%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-B4pcDUwBbK3t_448c2as49MMMS8rUeE1iJfYiOsTtQWlrXIUVfr449ZJrVaEDeeeqvsF0DP7oB6DF5V_I4VIOOxd83XNdRFv2G7zNuXVODiM5x88UxRADVuOthwY-JrFjZFFQ9Dv2fqT6x2N0ZlGAzyBVx-Q%26cry%3D1%26dbm_d%3DAKAmf-B9dvv_XJWopkRmopIsNufgam2SAMDKD3pw1GrEC4SELTOukb7ZfSBtFYUJE_K9BXxajoq9Dx4KsnondjtCqeqR5BSQ3CdVQoKbRHVLKuYaJDhJeYlJRjoUu7HGzMQ0qqOSJ6aOXpYZQZgSsHnZmWQB4v6lYZ66XsP4Rd3PS3fOMa_HmXqEOPCQjhT1dn1e_Ee6vS_92LzjZpnGz13VROSHSQov291AuPJUfF4Y0kP05yK6yiOgcOLE0ocfOVhr5GQUGpCI_6pPjOk_dVXGAG1nrg1LrdXLmY18QPrYjEPNpDR6Az_vYiDbClbjMNBHH3hyPcrr9J0QL7DtmQnA35xV4g4hecGGn8RpA7mPFUWRRV3FDPmA2Ue1GaN0SdxKZPR30bc07FqcfYtiiHkWIIoZ4cmVRFzM3cjAMbX0RV0_sbv3r4RFk-zj2XrIlr3-XPBO03Ki%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=1595731836652&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 155

https://hal900014.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=942122184e&subid=&uid=d985a6384a5be65a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZ60KfcjYbCtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_QLD9jwJXQFNQABi0ySzcKbI-BrP7Bn2NycgaJjCBCmKanaawFwYe_dLHnq6PdZZL_dcIeL9NpL7L7SBK37-K1IVDZnsPltQYe4Ueo3YjpKQGVDdZtl_h5lxdE073Q2c4a5tV33UaNme1wqnbHGOS2hEvFLs93h3e-KsvnvIFKAaE9iUBUXVj2W3z-WPzQLTwvm_W34yqnnFPL4x_qSpywsju2oCNWXYQ5Eb_rn3TVs1l0fzVnTVnEAqLyvHQrbFav2wIY-orOZKUy0DLgACHc8ODQls_-GRDABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRolv9vxbfTYsy6_iyBrZJxcHubBA%26sig%3DAOD64_1olfucxqgZ5xozkqle6zk2UCQ1AA%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-DAG1vZkE1zNrOZnWcgRriqMZ0b7UrsrDOb6HveYDdfvZ152dX8I_7QxmALftOi0FVlV8vV6IjLPeqm8BGLR0Y-YAdF8904b2Tg4gvxEWUVYdyhRTVGLy2qHUM5arIxD6ePbRB7VYegFhANLTJPrqHHhEgFFA%26cry%3D1%26dbm_d%3DAKAmf-BNVP-FZJwF1PtlPGDLSQJCcNaOMGCyteptIxFKR0qRJcX1_rs-1_GYB8eevGyy2ng5ERnNfxW33a_vEyy2On1K3_-B0lieSeBcj1c6VoNKzmQidkr_I2RKfoUH9tdW88CFSrEJJyfVvpTA021kdHa0M8BybDhnbw-ZKf3ju00aR8Ib8cMV6VAttKmeyQUIVF3SM9C5HMwNSsP0tn7OFSWGvqbYrrLyj4DJlYHBzsOzn-0YxrkSRvMr4alnOcQFtScDsRzWOH_FTQVILhvSzp6B-eN03pfQBHs8mfVxHo0DCVWCkZv_-f4ZVC7bSSX_OHoJ2JchU29hnByjOYrAe0h8_TS9xdeBY4fbr4a1_1krc77T8LGyuFiCjB-uYLUrFPgnSIZCA3denOT2Sq2mPnRj4tPRApJhpTXTUUFNJfZAg1GjaySnqPn2pTnOWLjislN6jWSX%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=9519821447074&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900014.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=942122184e&subid=&uid=d985a6384a5be65a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZ60KfcjYbCtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_QLD9jwJXQFNQABi0ySzcKbI-BrP7Bn2NycgaJjCBCmKanaawFwYe_dLHnq6PdZZL_dcIeL9NpL7L7SBK37-K1IVDZnsPltQYe4Ueo3YjpKQGVDdZtl_h5lxdE073Q2c4a5tV33UaNme1wqnbHGOS2hEvFLs93h3e-KsvnvIFKAaE9iUBUXVj2W3z-WPzQLTwvm_W34yqnnFPL4x_qSpywsju2oCNWXYQ5Eb_rn3TVs1l0fzVnTVnEAqLyvHQrbFav2wIY-orOZKUy0DLgACHc8ODQls_-GRDABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRolv9vxbfTYsy6_iyBrZJxcHubBA%26sig%3DAOD64_1olfucxqgZ5xozkqle6zk2UCQ1AA%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-DAG1vZkE1zNrOZnWcgRriqMZ0b7UrsrDOb6HveYDdfvZ152dX8I_7QxmALftOi0FVlV8vV6IjLPeqm8BGLR0Y-YAdF8904b2Tg4gvxEWUVYdyhRTVGLy2qHUM5arIxD6ePbRB7VYegFhANLTJPrqHHhEgFFA%26cry%3D1%26dbm_d%3DAKAmf-BNVP-FZJwF1PtlPGDLSQJCcNaOMGCyteptIxFKR0qRJcX1_rs-1_GYB8eevGyy2ng5ERnNfxW33a_vEyy2On1K3_-B0lieSeBcj1c6VoNKzmQidkr_I2RKfoUH9tdW88CFSrEJJyfVvpTA021kdHa0M8BybDhnbw-ZKf3ju00aR8Ib8cMV6VAttKmeyQUIVF3SM9C5HMwNSsP0tn7OFSWGvqbYrrLyj4DJlYHBzsOzn-0YxrkSRvMr4alnOcQFtScDsRzWOH_FTQVILhvSzp6B-eN03pfQBHs8mfVxHo0DCVWCkZv_-f4ZVC7bSSX_OHoJ2JchU29hnByjOYrAe0h8_TS9xdeBY4fbr4a1_1krc77T8LGyuFiCjB-uYLUrFPgnSIZCA3denOT2Sq2mPnRj4tPRApJhpTXTUUFNJfZAg1GjaySnqPn2pTnOWLjislN6jWSX%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=9519821447074&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 179

https://www.awin1.com/cshow.php?s=2882174&v=8508&q=413151&r=235229&pref1=98116500199684200719604011695024&pv=1 HTTP 302
https://www.zenaps.com/cshow.php?pvr=79bc9041-0448-11ec-a5ea-692d04ef6a29&v=8508&r=235229&q=413151&s=2882174&viewref=98116500199684200719604011695024&pv=1

Request Chain 180

https://www.awin1.com/cshow.php?s=2824569&v=9247&q=407742&r=235229&pref1=98116500199684200719604011695024&pv=1 HTTP 302
https://www.zenaps.com/cshow.php?pvr=79bd7aa0-0448-11ec-9723-692d00a25ac2&v=9247&r=235229&q=407742&s=2824569&viewref=98116500199684200719604011695024&pv=1

Request Chain 183

https://www.awin1.com/cshow.php?s=2898042&v=8361&q=383360&r=235229&pref1=98116500199684200719604011695024&pv=1 HTTP 302
https://www.zenaps.com/cshow.php?pvr=79bc9040-0448-11ec-a5ea-692d04ef6a29&v=8361&r=235229&q=383360&s=2898042&viewref=98116500199684200719604011695024&pv=1

Request Chain 198

https://www.awin1.com/cshow.php?s=2841812&v=19227&q=409216&r=235229&pref1=33897200160697300719604011695014&pv=1 HTTP 302
https://www.zenaps.com/cshow.php?pvr=79c96180-0448-11ec-9723-692d00a25ac2&v=19227&r=235229&q=409216&s=2841812&viewref=33897200160697300719604011695014&pv=1

Request Chain 202

https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=98116500199684200719604011695024&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png

Request Chain 211

https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=33897200160697300719604011695014&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif

Request Chain 212

https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=33897200160697300719604011695014&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg

Request Chain 224

https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 226

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D02bf1f51-763e-4bac-9f44-2a36e6af9a71%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID HTTP 302
https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=appnexus&uid=4657211381623794047

Request Chain 227

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID HTTP 307
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=true HTTP 307
https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=sovrn&uid=df264d5c67019dccc179de3a

Request Chain 228

https://pixel.advertising.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=02bf1f51-763e-4bac-9f44-2a36e6af9a71 HTTP 302
https://pixel.advertising.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=02bf1f51-763e-4bac-9f44-2a36e6af9a71&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=02bf1f51-763e-4bac-9f44-2a36e6af9a71&apid=UP7aba036c-0448-11ec-9474-0283af615fa2 HTTP 302
https://ups.analytics.yahoo.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=02bf1f51-763e-4bac-9f44-2a36e6af9a71&apid=UP7aba036c-0448-11ec-9474-0283af615fa2&verify=true HTTP 302
https://prebid.a-mo.net/setuid/verizon_video?uid=UP7aba036c-0448-11ec-9474-0283af615fa2&gdpr=0&gdpr_consent=

Request Chain 229

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID HTTP 302
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID HTTP 302
https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=pubmatic&uid=CE480BBC-F83B-48B4-A728-2E69C75EAB97

Request Chain 230

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dindex_rtb%26uid%3D HTTP 302
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dindex_rtb%26uid%3D&s=191503&C=1 HTTP 302
https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=index_rtb&uid=YSP3LN3ZSGwK0g6ct-umHAAA%261127

Request Chain 235

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm=&google_sc=&gdpr=1&gdpr_consent=&google_tc= HTTP 302
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEOLAk2dhLXAIe0of_rj-kwI&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1

Request Chain 236

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMxNDU5NTc5NDkyNTE1MjI2OA%3D%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMxNDU5NTc5NDkyNTE1MjI2OA%3D%3D&google_tc=

Request Chain 238

https://pr-bh.ybp.yahoo.com/sync/triplelift/3314595794925152268?gdpr=1&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=2662&xuid=y-nmqFLBNE2oReHSkRKsW9LuyoR2gYhYlPrmD7xHTAaw--~A&dongle=0883

Request Chain 239

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=1%26gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=3335&xuid=4657211381623794047&dongle=4d58&gdpr=1&gdpr_consent=

Request Chain 240

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=3314595794925152268 HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=3314595794925152268&dcc=t

Request Chain 241

https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

Request Chain 244

https://c1.adform.net/serving/cookie/match?party=14&cid=CE480BBC-F83B-48B4-A728-2E69C75EAB97 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=CE480BBC-F83B-48B4-A728-2E69C75EAB97

Request Chain 245

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6726905464725056262

Request Chain 247

https://dsp.adfarm1.adition.com/cookie/?ssp=9 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6999710014239013007

Request Chain 248

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=zkgLvPg7SLSnKC5px16rlw%3D%3D HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Request Chain 249

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=73946123-f72c-4600-9e96-3b5088edb41d

Request Chain 250

https://pixel.onaudience.com/?partner=214&mapped=CE480BBC-F83B-48B4-A728-2E69C75EAB97 HTTP 302
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25 HTTP 302
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25&xl8blockcheck=1 HTTP 302
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=55eb5fd5554a471dc0550df09865dcff

Request Chain 251

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0U0ODBCQkMtRjgzQi00OEI0LUE3MjgtMkU2OUM3NUVBQjk3&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 252

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK4iYhggtkInsUtONgt9sV8&google_cver=1

Request Chain 254

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=5510720183604041345

Request Chain 255

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:7d066123-f72c-4600-8d3e-7168c5f16442&gdpr=0&gdpr_consent=

Request Chain 256

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=8b81203c-cf97-4db6-893e-6bc1cc5ebd9a

Request Chain 257

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4657211381623794047&gdpr=0&gdpr_consent=

Request Chain 259

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=CE480BBC-F83B-48B4-A728-2E69C75EAB97&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-TEN73PhE2uXmwX9GuSIwTX2DaBvivp0-~A&gdpr=0&gdpr_consent=

Request Chain 260

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=f864fy_IuC9kxr15fMeneHCesnpknL8ofZ6MYJQp

Request Chain 261

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic HTTP 302
https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic HTTP 302
https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=2f2a67c1-8e78-44d6-9613-5bc2cf1610d2&ssp=pubmatic HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1f75fa9d-9060-48bc-8a42-031afa400c05&gdpr=&gdpr_consent=&gdpr_pd=

Request Chain 262

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=YSP3LAAD1Agb6wAC HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YSP3LAAD1Agb6wAC&gdpr=0&gdpr_consent=&_test=YSP3LAAD1Agb6wAC

260 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
ufile.io/
Redirect Chain

http://ufile.io/
https://ufile.io/

77 KB
21 KB

222ms
204ms

Document
text/html

2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48c154f0e5ffb407462a47a3cc1ee160a70cd56954bf5ae8782eff21a6f4fc30

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: ufile.io
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-type: text/html; charset=UTF-8
set-cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; Expires=Mon, 30 Aug 2021 19:29:44 GMT; Path=/ AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; Expires=Mon, 30 Aug 2021 19:29:44 GMT; Path=/; SameSite=None; Secure csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; expires=Tue, 24-Aug-2021 01:29:44 GMT; Max-Age=21600; path=/; domain=ufile.io ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; expires=Tue, 24-Aug-2021 19:29:44 GMT; Max-Age=86400; path=/; domain=ufile.io; HttpOnly __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL; SameSite=None; Secure; path=/; expires=Tue, 24-Aug-21 18:29:44 GMT; HttpOnly
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-frame-options: SAMEORIGIN
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ATzbSFdMAmmId5ynALYkCNamAknUu8xJzzUccIvOI3qkYFhg2240QZgOB6EnKOQ6%2BSih3GEE9aIT9T5CrgngbKsSUXGwQLEzRK%2BH%2BfvZmGfYr2SDaXbNiWEhVP3EUDI4ns3L%2BXj8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 6836c05b9fa42bc2-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

Date: Mon, 23 Aug 2021 19:29:44 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Mon, 23 Aug 2021 20:29:44 GMT
Location: https://ufile.io/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R7BKTwFvsQENSkZtEVMHv%2Fbgf10%2F6OXisp8UGvZcBtrq%2F2UdA%2B9IspJb9BZ8wLIqKhu%2FAXfGLxoTgSChrkZ1h3VLM3Gkj7j5b63V%2FV5YfQTmKXVf43fqe2zuyse3EjWI18WgbDg9"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 6836c05b58754e9d-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H3-29 200 roboto-v20-latin-100.woff2
ufile.io/assets/fonts/ 15 KB
16 KB 71ms
50ms Font
text/plain 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/fonts/roboto-v20-latin-100.woff2

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b7878571c8a713102fba10bf4a7b0eedf5980810b0780cbc1850ffc73f27c1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://ufile.io
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
:path: /assets/fonts/roboto-v20-latin-100.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: */*
cache-control: no-cache
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://ufile.io
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1763579
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 15808
last-modified: Tue, 03 Aug 2021 09:35:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yAAQ9hANKpF5teI60oRNo9Gmk3Xq%2FpUEdMAOPfqyTGcIFPHZw6E3MxrXWD1AVmqljyn4ZXJ12yg0baNp2KU0x7GTF3KnN75S5EqBGSVZcx1b%2FLkaaac7Dha7yByWTDkdoBks5vJ%2F"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6836c05d09614a9e-FRA
expires: Thu, 02 Sep 2021 09:36:45 GMT

GET
H3-29 200 23.jpeg
ufile.io/assets/img/backgrounds/ 37 KB
38 KB 72ms
51ms Image
image/jpeg 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ufile.io/assets/img/backgrounds/23.jpeg

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

19aa5d81b4a7a8966c7e03b3ec37dfddd22fc19718d57858fba0c6a9340ec6e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/img/backgrounds/23.jpeg
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 70174
cf-polished: status=not_needed
cf-bgj: imgq:100,h2pri,csam-hash
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 37827
last-modified: Thu, 19 Aug 2021 06:43:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k1%2BDmPes6UWVYROtXfhIH0R1oeA8Mrm4i2xxntBvSHiNM%2F9XGGAdeoFPsOj8Xq%2FxpbK40EK4OxvrSpJU8N7r93dmQBeLWgOWpM7QP2Ah%2Fc4e4uCfozjN0%2FOoa5XdOtJWZiFYaGcV"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
vary: Accept-Encoding
cache-control: max-age=15552000
accept-ranges: bytes
cf-ray: 6836c05d095c4a9e-FRA
expires: Sat, 19 Feb 2022 00:00:10 GMT

GET
H3-29 200 spacer.png
ufile.io/assets/img/ 34 B
757 B 108ms
104ms Image
image/webp 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ufile.io/assets/img/spacer.png

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/img/spacer.png
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 429490
cf-polished: origFmt=png, origSize=152
content-disposition: inline; filename="spacer.webp"
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 34
last-modified: Mon, 16 Aug 2021 09:52:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=focdalwRe5OL0eovxEq6IZvYwEj32uSiazYYig0XuzFAWES384tToQ0hsJwPfzNVrG5fqIm4erT9rJ62sOWvsmIU0QjzzjSZXsbDIpWjiEeYu%2BZH91LjsmcfoDA%2FwyUG%2BPIYh3X0"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
expires: Mon, 14 Feb 2022 20:11:34 GMT
cache-control: max-age=15552000
accept-ranges: bytes
cf-ray: 6836c05d09704a9e-FRA
cf-bgj: imgq:100,h2pri,csam-hash

GET
H3-29 200 dropzone.js Show response
ufile.io/assets/js/ 61 KB
17 KB 67ms
46ms Script
text/javascript 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/js/dropzone.js?v=1563114501

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d416d7edf7d9d6f041761f68d1057b9c1607be38b6d682e87266f54f2492baa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/js/dropzone.js?v=1563114501
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 726127
cf-polished: origSize=119870
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sun, 15 Aug 2021 09:46:14 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uGHKW%2FvNi60RJlxUuMmtT0SD5Dw694fXXosCVeoF2fGRnlLy32FR5bNHraLTHRB%2BWTO5SI9sHnOJ8mR5kXyfaVsMssneigcx4XzLcVj5Cmq%2F4ASdSzLYgwdfWxoFjO%2BWdFKhuoZ0"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cf-bgj: minify
cache-control: max-age=2678400
cf-ray: 6836c05d096b4a9e-FRA
expires: Tue, 14 Sep 2021 09:47:37 GMT

GET
H3-29 200 countup.js Show response
ufile.io/assets/js/ 4 KB
2 KB 55ms
34ms Script
text/javascript 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/js/countup.js?v=1563114501

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9386b81002b3ada59667c03a326520500de5db4f6c8252d5778203613bc19eb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/js/countup.js?v=1563114501
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 726127
cf-polished: origSize=7233
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sun, 15 Aug 2021 09:46:14 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kw81nhkbNUmdUlDfHSItZeJ5fRcIDT2z7hVMO6zEXYs4ygjjD9Tfoe6RCAyYfBh57M5PT2fS4yRwNLdHKTr9xGzLGjEogUyN%2B2u1Z3KEvQUKQD0p9FnpOmyL%2FhG7VfK0fxsY7Kh1"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cf-bgj: minify
cache-control: max-age=2678400
cf-ray: 6836c05d096a4a9e-FRA
expires: Tue, 14 Sep 2021 09:47:37 GMT

GET
H3-29 200 homepage.js Show response
ufile.io/assets/js/ 10 KB
4 KB 101ms
81ms Script
text/javascript 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/js/homepage.js?v=1563114501

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c9de5f49b6d663d965621b0fdf488395129590473a81ba80be2e4c841c2607cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/js/homepage.js?v=1563114501
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 726127
cf-polished: origSize=16549
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sun, 15 Aug 2021 09:46:14 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mByTIDJenRgKUbL3NmBeUvm1Wq3neUJOaQQfymIZ9okUtUTQRMmE1OGk%2Biz34NC1ocwPH0%2Fb3%2BHRt0TXLKt%2BvkXs8CZdAij85fYvqctBMqc30V%2F9zmJoXa%2BmSIpOUcTn2chKMxIF"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cf-bgj: minify
cache-control: max-age=2678400
cf-ray: 6836c05d09574a9e-FRA
expires: Tue, 14 Sep 2021 09:47:37 GMT

GET
H3-29 200 dropzone.css
ufile.io/assets/css/ 8 KB
2 KB 39ms
33ms Stylesheet
text/css 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/css/dropzone.css?v=1563114501

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11b5f6dfaf48d5ae3fbc61a289a621749cd6f68d16ea3b4dc05f8c90021637f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/css/dropzone.css?v=1563114501
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 726127
cf-polished: origSize=10764
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sun, 15 Aug 2021 09:46:14 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uheoP5xvhzYVcetaTSzscT0nG9QdGRCFv1QxyDC4aaNXSy8FV57MAHIz%2F67zJlPrh6Aq6jlCjjAzYogqPYA7J0%2BYoXlySzcSmb0uuh9cn%2F7pajZYGI1UL4%2BXzuOjpwI0d%2FdUyfoo"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-bgj: minify
cache-control: max-age=15552000
cf-ray: 6836c05d09694a9e-FRA
expires: Fri, 11 Feb 2022 09:47:37 GMT

GET
H3-29 200 bootstrap.css
ufile.io/assets/css/ 31 KB
7 KB 46ms
40ms Stylesheet
text/css 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/css/bootstrap.css?v=1563114501

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d45581f99961212923b84cdf880b7b6d1afcb01350ab8961a1271d7ba795053

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/css/bootstrap.css?v=1563114501
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 726144
cf-polished: origSize=41042
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sun, 15 Aug 2021 09:46:14 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OYu1AorIPFePeo%2FPzbJaCWetCsuG3xVadqkOC22aRThq9qvzUZli1lxEW6x6oe%2FyOnJ9cgU6Em%2FoA%2BgpHE%2B%2FERAYDuy6r%2Fg8NK5RBJzg3WlFRltJLjCpxPNqraIy7AtxCJxydy1w"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-bgj: minify
cache-control: max-age=15552000
cf-ray: 6836c05d095f4a9e-FRA
expires: Fri, 11 Feb 2022 09:47:20 GMT

GET
H3-29 200 theme.css
ufile.io/assets/css/ 86 KB
18 KB 49ms
43ms Stylesheet
text/css 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/css/theme.css?v=1563114501

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0f3b800e7da50f9ea322b9026d9d673c498e3bbeafe03bedb9889dc2bad102e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/css/theme.css?v=1563114501
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 726144
cf-polished: origSize=114411
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sun, 15 Aug 2021 09:46:14 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PL9pr1kynBKawgoWTQtXBicrrs5DkF5d48x%2Fn9OuToL%2F3NXigzyvZXIRBbf%2BSCwefrQQWeXlEQEHlIYaD1CJ6zO4gkyl%2Fnv4rnVAott4CENY6pRZqnhjAiI8jfbbiV7c5jxLpMAP"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-bgj: minify
cache-control: max-age=15552000
cf-ray: 6836c05d09744a9e-FRA
expires: Fri, 11 Feb 2022 09:47:20 GMT

GET
H3-29 200 utils.css
ufile.io/assets/css/ 60 KB
14 KB 94ms
88ms Stylesheet
text/css 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/css/utils.css?v=1563114501

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5f6486ad0481a073337fbfa0c22d2fe27e73f99874ca68702eb5c42e78f81677

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/css/utils.css?v=1563114501
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 726144
cf-polished: origSize=76432
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sun, 15 Aug 2021 09:46:14 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=773rFdM3theqVZd%2FfkybxYXJRmv5DCIywGNRoPw6UVW6sHR%2F77u992w6L%2FSg%2BpILjPj3abHK%2FLlrDB%2B8WuaEmrUo%2Fomqene%2Fcs15EPzuxAZ%2FBNrgfeKcksZ30DzN55sUkvfCsiEb"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-bgj: minify
cache-control: max-age=15552000
cf-ray: 6836c05d09764a9e-FRA
expires: Fri, 11 Feb 2022 09:47:20 GMT

GET
H2 200 fuse.js Show response
cdn.fuseplatform.net/publift/tags/2/2497/ 113 KB
18 KB 95ms
57ms Script
application/x-javascript 2a02:26f0:6c00::210:ba08
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.fuseplatform.net/publift/tags/2/2497/fuse.js
Requested by: Host: ufile.io
URL: https://ufile.io/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba08 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 794b9baf24cbf03da2db6e00fb01fa42b6545511f3c843863af1dc43d0ca92df

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: gzip
last-modified: Thu, 12 Aug 2021 06:33:34 GMT
server: AkamaiNetStorage
etag: "1b76f72b2339d21a5b9bafca213ab96b:1628750014.036773"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=276
accept-ranges: bytes
content-length: 18115
expires: Mon, 23 Aug 2021 19:34:20 GMT

GET
H3-29 200 api.js Show response
ufile.io/cdn-cgi/bm/cv/669835187/ 35 KB
10 KB 21ms
18ms Script
text/javascript 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/cdn-cgi/bm/cv/669835187/api.js

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:path: /cdn-cgi/bm/cv/669835187/api.js
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fHAepaCiwKxyvfCwIXYq%2B1r4GoVQb4S%2Fjr5BKoJ0TOUokraxP4GS1XJa2TpZQNLENCtZDZihVdy57QNxgNSRfWSJDNakC7Q%2FD4%2BzE4AHQYzGqE2atzwS5%2FoYyqYsuS6k1rckcwQL"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=604800, public
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-ray: 6836c05d095e4a9e-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H3-29 200 logo-dark.svg
ufile.io/assets/img/ 2 KB
1 KB 35ms
34ms Image
image/svg+xml 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ufile.io/assets/img/logo-dark.svg

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ccbcf6d22ea0b761807062453a2acd95a34bb9b2603b2650b605df1af2f2960

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/img/logo-dark.svg
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1763576
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Tue, 03 Aug 2021 09:35:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qaK31tKL9rY59yUT6Row6hjyUETQ0lpT5NrmL6unMVxlIn7w6mHXTGlCQP2I4csVBqgZVna4OLmusCoV97ij%2BHBtzzSZBKaYx2v1FcOqh2QaH0QZxAB6GuWLQ%2FtEkK7uIj1lhNd6"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: max-age=31536000
cf-ray: 6836c05d299c4a9e-FRA
expires: Wed, 03 Aug 2022 09:36:48 GMT

GET
H3-29 200 jquery.js Show response
ufile.io/assets/js/ 87 KB
32 KB 35ms
34ms Script
text/javascript 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/js/jquery.js

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

72037311a4dfde4d042df73e31b7cbeafc0bdf2aaa605b69aff3326015a396da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/js/jquery.js
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1763578
cf-polished: origSize=89500
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Tue, 03 Aug 2021 09:35:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LGGxG31SvTK1tPv7cXxdvfD%2B1Ea8RdUGzYJ%2BzOeKzRfb%2FvhijEE2vlfKylt9EfbuSjqpd3RWKMejXktpV%2FjZbQJSLrOpqyCQedI2ezyT1D2gRiAoAwQyS3Dfs2%2Fdyh1JEJFA37Ue"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cf-bgj: minify
cache-control: max-age=2678400
cf-ray: 6836c05d299d4a9e-FRA
expires: Thu, 02 Sep 2021 09:36:46 GMT

GET
H3-29 200 utils.js Show response
ufile.io/assets/js/ 33 KB
12 KB 23ms
22ms Script
text/javascript 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/js/utils.js?v=1563114501

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7f768f129c2c71cdd195bc42f800c081e5d9804df4df180f851497957822151

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/js/utils.js?v=1563114501
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 726144
cf-polished: origSize=47601
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sun, 15 Aug 2021 09:46:14 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WTiT4PQnxzkc8bDV%2FGvzMtv5l4nzaOCoZkoTQDNFB%2FJ8YgiSey4rdeCWiG6HqBVaTabxalrVOM8yubKvKVWeH4BkUhttj0ajSoFDB7XTOX4cXW5hS3edKzMEKn%2BWElp8UgFCAw%2FU"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cf-bgj: minify
cache-control: max-age=2678400
cf-ray: 6836c05d299e4a9e-FRA
expires: Tue, 14 Sep 2021 09:47:20 GMT

GET
H3-29 200 global.js Show response
ufile.io/assets/js/ 22 KB
6 KB 70ms
69ms Script
text/javascript 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/js/global.js?v=1563114501

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9074dbd6a7e81c9ecae5dff24308492f2859887b7e7dcc60d0466d6bf7fd24be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/js/global.js?v=1563114501
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 726144
cf-polished: origSize=36612
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sun, 15 Aug 2021 09:46:14 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fkcRKbBnGXn6uUvM0PCtk3L912Iy%2BTVEYdx%2Bi43BynLhaILMZlsAUFB4yGeg2TJVIfXD61UeHM53FHwZkJHkKBgDVQIfTAL0J4B8K77SDQ0RRCwdRDej3xyehL%2BhdiogHknl%2FTcO"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cf-bgj: minify
cache-control: max-age=2678400
cf-ray: 6836c05d29a24a9e-FRA
expires: Tue, 14 Sep 2021 09:47:20 GMT

GET
H3-29 200 ab.js Show response
ufile.io/assets/js/ 3 KB
2 KB 69ms
68ms Script
text/javascript 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/js/ab.js

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fc795b42e6ad7232caa5faba5cb169a76cffbfe54c147346af1d923fcd3ca9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/js/ab.js
pragma: no-cache
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1763577
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Tue, 03 Aug 2021 09:35:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GInUhwmbigMa5RD0oHnyOeHhLD%2FHEK%2FgobBl%2FZh6xuKQortKEwoq8pFw9tjHJWVQIgaCn4FJZKRBtzOW5NXFMgAJVN7K1yag%2B%2BRBoXLNMldE26M8Weo1vk%2BvrSJVqcZtMkOX0zxu"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cf-bgj: minify
cache-control: max-age=2678400
cf-ray: 6836c05d29a14a9e-FRA
expires: Thu, 02 Sep 2021 09:36:47 GMT

GET
H2 200 beacon.min.js Show response
static.cloudflareinsights.com/ 13 KB
5 KB 46ms
46ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js
Requested by: Host: ufile.io
URL: https://ufile.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e567066985125e7974f68b42914dcb134e3c38373a4a3d668bdb38a3e55f299

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: gzip
last-modified: Wed, 18 Aug 2021 21:41:27 GMT
server: cloudflare
etag: W/2021.5.3
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 6836c05d2fe94351-FRA

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Jul 2021 18:24:06 GMT
server: Golfe2
age: 963
date: Mon, 23 Aug 2021 19:13:41 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19672
expires: Mon, 23 Aug 2021 21:13:41 GMT

GET
H3-29 200 fa-solid-900.woff2
ufile.io/assets/fonts/ 74 KB
74 KB 29ms
28ms Font
text/plain 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/assets/fonts/fa-solid-900.woff2

Requested by

Host: ufile.io
URL: https://ufile.io/assets/css/utils.css?v=1563114501

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

638e43a6b51019f159d93c0e1c2d56eba3a8a0591ddd559727278ee653e28fc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://ufile.io
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
:path: /assets/fonts/fa-solid-900.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: */*
cache-control: no-cache
:authority: ufile.io
referer: https://ufile.io/assets/css/utils.css?v=1563114501
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://ufile.io
Referer: https://ufile.io/assets/css/utils.css?v=1563114501
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1763576
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 75440
last-modified: Tue, 03 Aug 2021 09:35:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XIwQEzAelYYjBApHoGm2BfThhBOCW2RiTCr%2FAv%2B7MUwt0yVp3iS4AXAko8Sr9Mss7cQMUYrYKy5k%2BIjgLp%2Bw9O%2FzagDN4qfTRBrHL4CeVGp2D%2BGw%2F7Mk4nT7dhvt9kTJVeS%2FxCER"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6836c05deb854a9e-FRA
expires: Thu, 02 Sep 2021 09:36:48 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 72 KB
25 KB 82ms
31ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/fuse.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

9a072b413b6580341066c7e856e8bf74f253d8c47bea5617fb9b91cfa6c6bb79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "968 / 624 of 1000 / last-modified: 1629737920"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25402
x-xss-protection: 0
expires: Mon, 23 Aug 2021 19:29:44 GMT

GET
H2 200 prebid.js Show response
cdn.fuseplatform.net/publift/tags/2/2497/ 206 KB
65 KB 175ms
175ms Script
application/x-javascript 2a02:26f0:6c00::210:ba08
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/fuse.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba08 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bb51ee26f61a59391e55c6188324ff192ac9494e14716bbf6e40cc7f495f8c18

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: gzip
last-modified: Thu, 12 Aug 2021 06:33:33 GMT
server: AkamaiNetStorage
etag: "64cd478c7f615d4a11b03f7c64038cfc:1628750013.994243"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=948
accept-ranges: bytes
expires: Mon, 23 Aug 2021 19:45:32 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 13ms
13ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j92&a=500191655&t=pageview&_s=1&dl=https%3A%2F%2Fufile.io%2F&ul=en-us&de=UTF-8&dt=Ufile.io%20-%20Upload%20files%20for%20free%20%26%20share%20them%20without%20registration&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=370878220&gjid=1520588706&cid=1197098049.1629746985&tid=UA-73416834-1&_gid=154237176.1629746985&_r=1&_slc=1&z=259620377

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ufile.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 result Show response
ufile.io/cdn-cgi/bm/cv/ 0
779 B 10ms
10ms XHR
text/plain 2606:4700:21::681b:c358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ufile.io/cdn-cgi/bm/cv/result?req_id=6836c05b9fa42bc2

Requested by

Host: ufile.io
URL: https://ufile.io/cdn-cgi/bm/cv/669835187/api.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:21::681b:c358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-fetch-mode: cors
origin: https://ufile.io
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
cookie: AWSALB=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; AWSALBCORS=q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG; csrf_cookie_name=21b8fabe81fb272e6295ec8f01f9798a; ci_sessions=059f9c98oerkudd5u41h5reif7b8f9pf; __cflb=02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL; _ga=GA1.2.1197098049.1629746985; _gid=GA1.2.154237176.1629746985; _gat=1
content-length: 424
:path: /cdn-cgi/bm/cv/result?req_id=6836c05b9fa42bc2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: ufile.io
referer: https://ufile.io/
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CjiIM0j%2F2lINSTOB8TPaR2xoa0%2BNq%2FHJvCgfywi5J2bXNf9ldeYqbGP6VGBrFW2%2FTww4E5LApAcRobhSyL91QjcZSEtr4%2Fs7b72vou4N2Ub%2Ft9YjNGK5Q%2BkbXjcQT%2BWBn2dSDfE2"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
set-cookie: __cf_bm=6c0fbbcfd683d91a78f7edd5e8038177bdc155c4-1629746984-1800-AT6Jy9eBNUtRtE82Ne6bxztIXV/IVlnMtnpEO0j0lhdfiMAnVkUXMQ/7wxXGONvp3RKm4n5rlU42vi+hxB9BaQeatnD5gFDwHi6P2FyAx5DjzjchOfaVkSbcmSUdr/Am6KsuGWOZGzAgvsHJoEpeC0s=; path=/; expires=Mon, 23-Aug-21 19:59:44 GMT; domain=.ufile.io; HttpOnly; Secure; SameSite=None
cf-ray: 6836c05e8d0a4a9e-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
80 B 15ms
14ms XHR
text/plain 2a00:1450:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-73416834-1&cid=1197098049.1629746985&jid=370878220&gjid=1520588706&_gid=154237176.1629746985&_u=IEBAAEAAAAAAAC~&z=1395374398

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 23 Aug 2021 19:29:44 GMT
content-type: text/plain
access-control-allow-origin: https://ufile.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 pubads_impl_2021081901.js Show response
securepubads.g.doubleclick.net/gpt/ 331 KB
116 KB 67ms
37ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

50235ec9793a0ef9fa1e16fc5d47fdfd56f199b343586308c7cbec1e9937435a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 19 Aug 2021 08:39:07 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 118670
x-xss-protection: 0
expires: Mon, 23 Aug 2021 19:29:44 GMT

GET
H3-29 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 105 B
112 B 60ms
30ms XHR
application/json 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=ufile.io

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

93e6b4435d1335304d52661e756ee08beb2c92d96ef62310efeb57cc09e9d16c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87
x-xss-protection: 0
expires: Mon, 23 Aug 2021 19:29:44 GMT

GET
H2 200 integrator.js Show response
adservice.google.nl/adsid/ 107 B
853 B 37ms
16ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/adsid/integrator.js?domain=ufile.io

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
14ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ufile.io

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 583 B
1 KB 108ms
42ms XHR
application/json 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

6c32f36b9973c4164ba6b9489685b814ee69e1b9c068796b28e8868edd0e20f5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 23 Aug 2021 19:29:45 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 213.232.87.179; 213.232.87.179; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: e1d7b65b-7da3-4f0a-8459-f6bb6b03563d
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://ufile.io
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 861 B
782 B 478ms
289ms XHR
application/json 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 984b348e6ee727db5531514db74def6373130fd06ad69568674c09ad5af8d7ef

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 193
content-length: 356

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
259 B 150ms
102ms XHR
application/json 3.123.48.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=3.27.1&referrer=https%3A%2F%2Fufile.io%2F&tmax=1000

Requested by

Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.123.48.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-123-48-64.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:45 GMT
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 v2 Show response
i.connectad.io/api/ 0
360 B 76ms
54ms XHR
text/plain 2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://i.connectad.io/api/v2
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://ufile.io
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6836c05ffc564ed3-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
347 B 357ms
122ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: 097418ec66aae7247317ef1a2084f927f410a43d292a576b266707de0f52526f

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
347 B 358ms
123ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: f3670767b1eb59f50471a503f7cd7bc6657147e9e57663ece58a94756bf36ed5

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
338 B 451ms
215ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: d044c71ec435f83929bffbc134b7f5d95a3b9654cef39a5fb59ee606707ff77f

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
338 B 450ms
215ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: fb9d20b37b11d2231f752dd1a8edb1394b3345fd682beae62c19cb6c1de22765

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 65 B
337 B 438ms
203ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: 4f8f66f89b9a04c7a86ec677129f7ca1e70f881a8440b49f634699e953da39c9

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
338 B 356ms
121ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: a360ccdab0ef394c3269af2251321cb022415f776968eb98031f9d623bbb9370

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
347 B 436ms
201ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: b3f1bbc557dc2ed8f38b03787d581ec132f83b8683f872b3f9c5364706e753a8

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
338 B 357ms
123ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: fa37fadc4b97fd670f3347bb11240c68153add0170aee54fd555c682aed7533a

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 65 B
337 B 449ms
215ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: 11cfb56ce29d79384befd6f723e6a96b17bd1d33888642bb7c1fc08d8360fca8

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 65 B
337 B 438ms
204ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: f2ffb31507b69e5bce642956ea53a12d5764ec30efa659fb4d983d3266bd48d8

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
338 B 448ms
214ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: 4d803e2074e76f3384fca464f31803c3b894ff65d8649c7100844cf217f50128

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
338 B 449ms
215ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: 7ee8293223afaf5060299bf1d62b7cb1138331fc26e6f91b7108e9f9a3278d51

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
338 B 437ms
204ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: 131a0a1443ee966b0ff6de6e94ce4e6b1a6b114778bc819b9152a6f1e90d3ebd

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
338 B 438ms
204ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: 530fb14ac132185b8671f12b9812823e92de9c56399cb9d1b3f196e2baca8b90

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ufile.io
access-control-allow-credentials: true

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
111 B 149ms
114ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ufile.io
date: Mon, 23 Aug 2021 19:29:44 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 l.js Show response
client.crisp.chat/ 8 KB
3 KB 33ms
17ms Script
application/javascript 2606:4700::6812:1d5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://client.crisp.chat/l.js

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1d5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43619c3dffc4b881e3b2a5b4cee7f1fbb90426c9a58b77a08628683c751a87a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 36874
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Thu, 29 Jul 2021 08:17:59 GMT
server: cloudflare
etag: W/"61026437-1e7b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 300
access-control-allow-methods: HEAD, GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=86400
access-control-allow-credentials: false
cf-ray: 6836c05fffa5d6ed-FRA
access-control-allow-headers: Content-Type, Origin
expires: Tue, 24 Aug 2021 19:29:44 GMT

POST
H2 200 rum Show response
cloudflareinsights.com/cdn-cgi/ 0
77 B 11ms
11ms XHR
text/plain 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudflareinsights.com/cdn-cgi/rum

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/json

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://ufile.io
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 6836c0603abe4eb0-FRA
vary: Origin

OPTIONS
H2 200 rum
cloudflareinsights.com/cdn-cgi/ Frame 0
0 46ms
16ms Preflight
text/plain 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudflareinsights.com/cdn-cgi/rum

Protocol

Server

2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://ufile.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 23 Aug 2021 19:29:44 GMT
content-type: text/plain
access-control-allow-origin: https://ufile.io
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-max-age: 86400
vary: Origin
access-control-allow-credentials: true
server: cloudflare
cf-ray: 6836c0601a764eb0-FRA
x-frame-options: DENY
x-content-type-options: nosniff
content-encoding: gzip

GET
H3-29 200 client.js Show response
client.crisp.chat/static/javascripts/ 384 KB
90 KB 477ms
466ms Script
application/javascript 2606:4700::6812:1d5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://client.crisp.chat/static/javascripts/client.js?147f49b

Requested by

Host: client.crisp.chat
URL: https://client.crisp.chat/l.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:1d5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36245251d14ffbce7a49e9017877bae271dba30811a989d6b373aa43832d8c73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 40244
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Thu, 29 Jul 2021 08:17:59 GMT
server: cloudflare
etag: W/"61026437-6014f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 300
access-control-allow-methods: HEAD, GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=315360000
access-control-allow-credentials: false
cf-ray: 6836c060291c6443-FRA
access-control-allow-headers: Content-Type, Origin
expires: Thu, 21 Aug 2031 19:29:44 GMT

GET
H3-29 200 client_default.css
client.crisp.chat/static/stylesheets/ 328 KB
40 KB 36ms
25ms Stylesheet
text/css 2606:4700::6812:1d5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://client.crisp.chat/static/stylesheets/client_default.css?147f49b

Requested by

Host: client.crisp.chat
URL: https://client.crisp.chat/l.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:1d5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4aeeb4372ccca59c3a12c0f20db95a990f9bf269886a8e04addf669b1bcf992a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 40244
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Thu, 29 Jul 2021 08:17:59 GMT
server: cloudflare
etag: W/"61026437-52116"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 300
access-control-allow-methods: HEAD, GET, OPTIONS
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=315360000
access-control-allow-credentials: false
cf-ray: 6836c060391d6443-FRA
access-control-allow-headers: Content-Type, Origin
expires: Thu, 21 Aug 2031 19:29:44 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.nl/adsid/ 107 B
122 B 31ms
15ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/adsid/integrator.js?domain=ufile.io

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 32ms
16ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ufile.io

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 137 KB
29 KB 470ms
469ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4211425590730756&correlator=303129952081934&output=ldjh&impl=fifs&eid=31062338%2C31062340%2C21068031%2C31062352%2C31062297&vrg=2021081901&ptt=17&sc=1&sfv=1-0-38&ecs=20210823&iu_parts=71161633%3A22528092585%2CUFILEIO_ufileio%2Chome_header%2Chome_incontent_1%2Chome_incontent_2%2Chome_incontent_3%2Csticky_footer&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5%2C%2F0%2F1%2F6&prev_iu_szs=728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C728x90%7C970x90&prev_scp=publift_mv_testing%3Dexploration4%7Cpublift_mv_testing%3Doptimized%7Cpublift_mv_testing%3Doptimized%7Cpublift_mv_testing%3Doptimized%7Cpublift_mv_testing%3Dbenchmark&eri=1&cust_params=fuse_profanity%3Dfalse%26fuse_site%3Dufile.io%26fuse_path%3D%252F%26fuse_query%3D%26fuse_category%3D%26fuse_industry%3DIAB19%26inskin_yes%3Dtrue%26fuse_uuid%3D180eaaa1-eb54-4a99-915e-931cb6987741&cookie_enabled=1&bc=31&abxe=1&lmt=1629746985&dt=1629746985422&dlt=1629746984464&idt=426&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C436%2C436%2C436%2C436&adys=90%2C1569%2C3317%2C4952%2C1200&adks=1204161151%2C1989291224%2C2046995897%2C236762470%2C2351176462&ucis=1%7C2%7C3%7C4%7C5&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&u_java=false&flash=0&url=https%3A%2F%2Fufile.io%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1110x250%7C1110x250%7C1110x250%7C1110x250%7C1600x-1&msz=728x0%7C728x0%7C728x0%7C728x0%7C728x-1&ga_vid=1197098049.1629746985&ga_sid=1629746985&ga_hid=500191655&ga_fc=false&fws=128%2C128%2C128%2C128%2C640&ohw=0%2C0%2C0%2C0%2C0&btvi=0%7C1%7C2%7C3%7C4&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

fe2fe85118c84a34bed1d4e7836cdeaef1535ba6aed70c7361f0cb756cc16222

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29472
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ufile.io
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6F28 6 KB
3 KB 46ms
14ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ufile.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ufile.io/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 23 Aug 2021 19:29:45 GMT
expires: Tue, 23 Aug 2022 19:29:45 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 / Show response
client.crisp.chat/settings/website/9891a594-d15f-44d2-ad63-5e086be01a3a/prelude/ 78 B
497 B 16ms
16ms Script
application/javascript 2606:4700::6812:1d5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://client.crisp.chat/settings/website/9891a594-d15f-44d2-ad63-5e086be01a3a/prelude/?callback=window.%24crisp.__spool.website_handler&2021-7-23-21-29

Requested by

Host: client.crisp.chat
URL: https://client.crisp.chat/static/javascripts/client.js?147f49b

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:1d5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53c4d41f16e87d4bbc6030da4f6a2da8b51ced36d252be39c777261f3a0ac537

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9033
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 300
access-control-allow-methods: HEAD, GET, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=14400
access-control-allow-credentials: false
cf-ray: 6836c06359f26443-FRA
access-control-allow-headers: Content-Type, Origin
expires: Mon, 23 Aug 2021 23:29:45 GMT

GET
H3-29 200 / Show response
client.crisp.chat/settings/website/9891a594-d15f-44d2-ad63-5e086be01a3a/ 4 KB
2 KB 16ms
15ms Script
application/javascript 2606:4700::6812:1d5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://client.crisp.chat/settings/website/9891a594-d15f-44d2-ad63-5e086be01a3a/?callback=window.%24crisp.__spool.website_handler&1628671231592

Requested by

Host: client.crisp.chat
URL: https://client.crisp.chat/static/javascripts/client.js?147f49b

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:1d5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e965d20da290ec24b2da39b0e94a617c69afc466297e9990b56ce8a42fe85e15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:45 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 14308
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 300
access-control-allow-methods: HEAD, GET, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=14400
access-control-allow-credentials: false
cf-ray: 6836c0648a456443-FRA
access-control-allow-headers: Content-Type, Origin
expires: Mon, 23 Aug 2021 23:29:45 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012108100143000/ Frame 5465 188 KB
54 KB 66ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108100143000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80552188ade64dd7f4ffd7b9dc82b63a67cd59265cde1fb838d7a0d4f0cc56e9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 542646
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55213
x-xss-protection: 0
server: sffe
date: Tue, 17 Aug 2021 12:45:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "2f5786613d323c5a"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 12:45:39 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012108100143000/v0/ Frame 5465 13 KB
6 KB 64ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108100143000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cce2d9e56822ca13d0bc323ca0d7a4a6205b58a7006eea4ca3256f77da7a6a0c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 542646
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4877
x-xss-protection: 0
server: sffe
date: Tue, 17 Aug 2021 12:45:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0140540fbe581c13"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 12:45:39 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012108100143000/v0/ Frame 5465 89 KB
28 KB 75ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108100143000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80f5433df727188d43a64cda6f7060bc5117045b2cbcd1492a00183caff5f1ec

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 542646
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28511
x-xss-protection: 0
server: sffe
date: Tue, 17 Aug 2021 12:45:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "07ab47082d8b4bd2"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 12:45:39 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012108100143000/v0/ Frame 5465 4 KB
2 KB 65ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108100143000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

607fe49372f521f5a6c6c7fcde31ebb07f017c1efea75cbbf167612641e006e7

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 542646
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1660
x-xss-protection: 0
server: sffe
date: Tue, 17 Aug 2021 12:45:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "758b6350805b356b"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 12:45:39 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012108100143000/v0/ Frame 5465 40 KB
13 KB 78ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108100143000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9dd189ef52ea74a10651864dd73d21639d99289fb8ca5be69df4aa29c81afc4d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 542646
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12835
x-xss-protection: 0
server: sffe
date: Tue, 17 Aug 2021 12:45:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "e9aa942d03505fee"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 12:45:39 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 5465 3 KB
687 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

86004aba5435fd4a14892a5f47e53a870f8e8b815b33737be419bee2bef6080e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 23 Aug 2021 17:35:55 GMT
server: ESF
date: Mon, 23 Aug 2021 19:29:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 23 Aug 2021 19:29:45 GMT

GET
DATA 200
OK truncated
/ Frame 5465 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7356ab868d5ac2fbd75980c9066c3057d479510e449c518f608f0f15a250e724

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5465 2 KB
3 KB 6ms
6ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 15:34:33 GMT
x-content-type-options: nosniff
server: cafe
age: 14112
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 24 Aug 2021 15:34:33 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5465 295 B
399 B 7ms
6ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 12:37:33 GMT
x-content-type-options: nosniff
server: cafe
age: 24732
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 24 Aug 2021 12:37:33 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 5465 0
0 15ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQBunhdNZ66oENrvgdhHpFe7cI85Qxc35iG_53QpDEHgHOhQx9CsjG9TfIsbyNDzxd7lzV_CGG5mmVYtP0o73Yn8btIVQ
Requested by: Host: ufile.io
URL: https://ufile.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 5465 0
0 57ms
57ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C3RlKKfcjYa-tHeiU7_UP-NeEoA-AzdfDZI_2vt--DP_1kOPXAhABINPLzjBgkYSAgPwXoAGr1bS7AsgBAeACAKgDAcgDCqoE3wFP0EJ6Sv8JKDk-8gXJRdXe8LZMoqamxSByWGM1wNOJgzqtsBkR3xRJYOxUGP73rog1x9_0j4VGBhbKUMG742HoH1DOBFU-A0eQ35we3biLkeJ6ZsgTOWNKrCPc0gsvBaHAFce9uqdTPZVU8shyUL_USxrGNWMBcnThl9grvVJrJFb6WJ0sVgXdCnKdcXWJUPrUYbbICHXWma24BlqSCSa03jmnBnBDr58IrGTqcONXgsz7F704b7yvOmKnofGoHXglvA_xf82DES0vJ9P8tp5MBVRUmTjs9zD4d7aQUUaQwASjsbfynwPgBAGSBQQIBBgBkgUECAUYBIAH7rKWzwGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQl7FP0ggJCIjhgBAQARgdgAoDyAsB2BMM0BUBgBcBshceChwIABIUcHViLTU4ODQyOTQ0NzkzOTE2MzgYmdIh&sigh=nlBXz-pvfP4
Requested by: Host: ufile.io
URL: https://ufile.io/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H2 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v35/ Frame 5465 21 KB
21 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v35/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ufile.io
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 00:01:11 GMT
x-content-type-options: nosniff
age: 502114
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 00:01:04 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Aug 2022 00:01:11 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v35/ Frame 5465 21 KB
21 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v35/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ufile.io
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 00:01:03 GMT
x-content-type-options: nosniff
age: 502122
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 00:00:52 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Aug 2022 00:01:03 GMT

GET
H3-29 200 container.html Show response
a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E8A3 6 KB
3 KB 22ms
7ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ufile.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ufile.io/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 23 Aug 2021 19:29:45 GMT
expires: Tue, 23 Aug 2022 19:29:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 78E8 6 KB
3 KB 18ms
7ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ufile.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ufile.io/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 23 Aug 2021 19:29:45 GMT
expires: Tue, 23 Aug 2022 19:29:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 32C1 6 KB
3 KB 16ms
8ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ufile.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ufile.io/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 23 Aug 2021 19:29:45 GMT
expires: Tue, 23 Aug 2022 19:29:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012108100143000/ Frame E30E 188 KB
54 KB 28ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108100143000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80552188ade64dd7f4ffd7b9dc82b63a67cd59265cde1fb838d7a0d4f0cc56e9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 542647
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55213
x-xss-protection: 0
server: sffe
date: Tue, 17 Aug 2021 12:45:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "2f5786613d323c5a"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 12:45:39 GMT

GET
H3-29 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012108100143000/v0/ Frame E30E 13 KB
5 KB 36ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108100143000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cce2d9e56822ca13d0bc323ca0d7a4a6205b58a7006eea4ca3256f77da7a6a0c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 542647
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4877
x-xss-protection: 0
server: sffe
date: Tue, 17 Aug 2021 12:45:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0140540fbe581c13"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 12:45:39 GMT

GET
H3-29 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012108100143000/v0/ Frame E30E 89 KB
28 KB 35ms
17ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108100143000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80f5433df727188d43a64cda6f7060bc5117045b2cbcd1492a00183caff5f1ec

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 542647
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28511
x-xss-protection: 0
server: sffe
date: Tue, 17 Aug 2021 12:45:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "07ab47082d8b4bd2"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 12:45:39 GMT

GET
H3-29 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012108100143000/v0/ Frame E30E 4 KB
2 KB 25ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108100143000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

607fe49372f521f5a6c6c7fcde31ebb07f017c1efea75cbbf167612641e006e7

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 542647
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1660
x-xss-protection: 0
server: sffe
date: Tue, 17 Aug 2021 12:45:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "758b6350805b356b"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 12:45:39 GMT

GET
H3-29 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012108100143000/v0/ Frame E30E 40 KB
13 KB 26ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108100143000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9dd189ef52ea74a10651864dd73d21639d99289fb8ca5be69df4aa29c81afc4d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 542647
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12835
x-xss-protection: 0
server: sffe
date: Tue, 17 Aug 2021 12:45:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "e9aa942d03505fee"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 12:45:39 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame E30E 3 KB
578 B 19ms
16ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

86004aba5435fd4a14892a5f47e53a870f8e8b815b33737be419bee2bef6080e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 23 Aug 2021 18:48:20 GMT
server: ESF
date: Mon, 23 Aug 2021 19:29:46 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 23 Aug 2021 19:29:46 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E30E 2 KB
2 KB 18ms
13ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 15:34:33 GMT
x-content-type-options: nosniff
server: cafe
age: 14113
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 24 Aug 2021 15:34:33 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E30E 295 B
319 B 18ms
13ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 12:37:33 GMT
x-content-type-options: nosniff
server: cafe
age: 24733
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 24 Aug 2021 12:37:33 GMT

GET
DATA 200
OK truncated
/ Frame E30E 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee49247c1e3cae5249689b033a944e7970fe9930796f93c0bb3b3a6c86db34fa

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame E30E 0
0 81ms
80ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C6NyZKfcjYbOtHeiU7_UP-NeEoA-AzdfDZM3aiPugDf_1kOPXAhABINPLzjBgkYSAgPwXoAGr1bS7AsgBAeACAKgDAcgDCqoE4QFP0AQWXJA1-vYgET2tYKHznB90n45QBQfHNvxTdOPdIJhWxoGPtD3xjiSzaaxOD4ncMVO97cIhbTrYXz85JzIPEf-SOUVDyYC6T4-m0N6LTCdwTlKtx0aQlDoJOxpdvZZ89zQ3hnLs6V29RFWPY-ros7IFOm5KrDc_o_AumgbaX3OQqJwzCSCqIUo35uXTqloF0AGvySpH6zAnCE5YvaKoKRINqPkisq7GMr8ESqGMMxGeIe5ogCF-oljutZOuv06lRjcXFXdeYLOtBMFX2iNKndJyZJMQzTQnsY2TCac1syvABLnel-bAA-AEAZIFBAgEGAGSBQQIBRgEgAfuspbPAagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBDdrBbSCAkIiOGAEBABGB2ACgPICwHYEwzQFQGAFwGyFx4KHAgAEhRwdWItNTg4NDI5NDQ3OTM5MTYzOBiZ0iE&sigh=QQpXDzwkYEI
Requested by: Host: ufile.io
URL: https://ufile.io/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 19ms
16ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a2478978968eefdc87127bfe6619a9de514b2ccb89b2a95824a53e6bea1f9cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:46 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629458978809797"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27677
x-xss-protection: 0
expires: Mon, 23 Aug 2021 19:29:46 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 28ms
27ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021081901&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

daf1a58c0da7232cc995f0e1c211cb4d9212df84a65b1b57b5f15879b6349677

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 19:29:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8520
x-xss-protection: 0

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v35/ Frame E30E 21 KB
21 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v35/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ufile.io
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 00:01:32 GMT
x-content-type-options: nosniff
age: 502094
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 00:01:04 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Aug 2022 00:01:32 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v35/ Frame E30E 21 KB
21 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v35/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ufile.io
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 00:01:15 GMT
x-content-type-options: nosniff
age: 502111
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 00:00:52 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Aug 2022 00:01:15 GMT

GET
H3-29 200 en.js Show response
client.crisp.chat/static/javascripts/locales/ 6 KB
3 KB 14ms
13ms Script
application/javascript 2606:4700::6812:1d5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://client.crisp.chat/static/javascripts/locales/en.js?147f49b

Requested by

Host: client.crisp.chat
URL: https://client.crisp.chat/static/javascripts/client.js?147f49b

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:1d5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

abdcd261c1ec6cb1b838a7302139f22740f6eeae1795a968867d4b166e207183

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 32371
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Thu, 29 Jul 2021 08:17:59 GMT
server: cloudflare
etag: W/"61026437-1822"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 300
access-control-allow-methods: HEAD, GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=315360000
access-control-allow-credentials: false
cf-ray: 6836c066fabf6443-FRA
access-control-allow-headers: Content-Type, Origin
expires: Thu, 21 Aug 2031 19:29:46 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 13B0 624 B
344 B 17ms
16ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVT7Ms0o7A-aHsNpZhcaUyQTI712FHxV-c2zLHC_cgAeMWR1HphwCk4xvsDefmqA3pOgrAxaHtTS6kGIqfNdd4zEKWHzmbKUTLp6lcuEaJGQYAJ50Z0jJlIJTMZm4SNusqD3oP72TDMfmBIzQhrQgfPii6Ifqadd1wUOmuQ_5MzQhUeq0w

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVT7Ms0o7A-aHsNpZhcaUyQTI712FHxV-c2zLHC_cgAeMWR1HphwCk4xvsDefmqA3pOgrAxaHtTS6kGIqfNdd4zEKWHzmbKUTLp6lcuEaJGQYAJ50Z0jJlIJTMZm4SNusqD3oP72TDMfmBIzQhrQgfPii6Ifqadd1wUOmuQ_5MzQhUeq0w
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmjaPk-2xCBFZ--MWEASttvgkgqj7vxGmdwIKUD2sn6NsSKltzrrHT9OPg0wzw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 23 Aug 2021 19:29:46 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 78E8 24 KB
13 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DMIUypujdfVjJ716osgFNjD5-fCO409Azw5xchhpDRhHudV0vbNgf-W3y6oUWRxjHpGLyxRMfmI_QwZV0fIu2IaX969OfUbbKOe194YKRQ9s37InMiuYaBSBo4hxMUfYaor_R8Y4HNsO-kza3PzQ6sOl9wDw&cry=1&dbm_d=AKAmf-DVSgJLuTFYcKtqBfKHyRTi91O7JuS3mPk2RepEiU1wkyn_YA062Ktv2pZMAVcLoSA74EfZhjiyb2usBnG6GcCrGPZGambDqYOyvrZu1q8iDiiqIuGuZWI4zgxqZRyeM2Rqf1whdeYPB7C2DtCxfUlIPz5GsRNY6kN48GvCevV284tz1w5VhUldrg5EwK6gMGpH6K0nt4owrJg0rd9gNobAFElF8cVnTpv1rgBvHRkUmDTzd1Gf7T1WPrbzNRKfXIsKAkUDv9mestneWX0ZBxT0vLUkP3WSR4OsjPEJaZmH0RLeccS55JuiCfASnoWYwRLe2pOpCOCxC8XJ3Yr9o87qJLlK3jcm0L06I8ZvYojwDzrTi7kgEVfSNng34EwWwGOd4-Eu2epO67azLj2HPkxG2bzi8TC1Yb2as-RH8OfWw6LAkQO7zmr0x22bdvgrdg3pV6HGhrYmMuumfEl3Zm5_zSVEiaFQykaDRegZjX0xHD7w5M80Ks8fg9FEvQJ02ML9S1MZO4uH89G4H0Sn4sVdRAc4brdsacYbM1-YW_kM_tvKjocQiMschPEZMKG5BcMeGx8aC2Q30iKtKeMQk7OuXmVA30-hGVbMZGw6R01KJ2b4NxuxfOshhfK-6OTPWbIQHdiXrGCp6ankyK2cD-ODukN3z7co96qPZBivbl3S6k6JfM_60wUnMHxaqGsuxUchdzrfLhBA389oGe8X7atmCqSDkEVehC3EYOA-pzWTYtgVim2q-XhwtjuBIvXPtgKh14BvVhW7H1AP7LdYk-0if7cocnwDBy1vEY0MPLL30KEL2J2wJWx0p-R96PUbJ4zcl-K8z4RkpY_niJ1uIidDfgYsGkQrYjwyDjtsmS4gaDyYRZSBgwANbenGsNMIBpPrZoCtaU_eLGsbcR1KrjECxH2u4l8INFK_8XZF5T22t502-qyaWNM6LzheJWGyfzS8lXgr2qutuhrkNDzQCB0oLjCP2pGRNh0DEhe-qG0JZxOURXYksPZ_knKDXCezVQRQWil8bS81jaLGDv_IH_5-7SoGOKZcDXutGxnaI0JMJEHnsrzwY8RLpEcmKKv0e2mNxsuB5t0Qp_5ULIXZsw_06D-tA5kxP9eHwQ1XHWLqL8H8uVtJv1RsB3FJp9PLfvNP27OgLqRUy1Mqq9nd95obW79NfYJm_wdBoCK4gTyVorSz3DPbDcHQ4UgvlUWANlKLwOWwLJTSnEdZP0mgo1mUhC2f3Dx78ozo4xDj90xiMSFY0wuyLqyiq8pQ6-ZEeQwukhHC-lghE6tZJDOEpnRMJ5FhrRSsVbYMPUjI3J_fThX3ARlQTCP3NlP7KngAUK3dNTpErWPd8Qu6ef-MtG5qMxKb0aCRK2-8da2hkBkdT0VVyh2C_lctx9Xhd8xt2I4wlBFMq6qsgCTD6h0TGcHmUJscnRP9JaNvX3bUwYfzTUQ-18sjDUFlcdUFHKsgNuLwqSi5xjLw79Yw4wphqfCjF9rUNJc7dxj7ByhaJ7ho31WN8dKWMMxxp39_TLXROJFmxAVl4CfTd9WVGYn55YYqSfjbWUGgPfIV9ss9UsEFEe-NjTUFy9rOlYLRk525uMhEoaebr4FrXB7KOdAIJ1S3js8iKEn7Syqj72ycGT53xFGWX5OpTrIkbwDvBhYMK4-s6PFQTlDkUxYoiqfU0sngJBBE9QMOl6_I2FpGLy2IpNNaSRbToxGMxxoWnxN5Tj5HM-ylAAso_4bhBwpx8wGgmi2mHF1ClBrAvDq1BCLVBIE6RNCEDJ1Y9Mubvesen4grvo3h5huRnkUH0rsJpp2id8cpgONB90g5Zt-H4nZSbb98nzuDz9__PeQusPnT9hzUyH1ClYhWIHeDQd67z5-CAOKYplDRRdW7qwodDZSKF9RDvL_kD-ZV5BTeMCDhfddRmqyce9ZwlbQdwGPss7_92AtuVPv8GnzsS21QJ2gUT0bY3RJTidLtPtuDMlfNKsBCEZONH_v3ILgdIMafH_OvvQgsrVvcNAD0wdYTLF-YJuJSJzPZ1OpI6B3SoUi5iYZcGBsf0GATKES29tQtIxwe8TzYClFvodaXry-eMhA5OTe7s3RCZvmTWKDdUpIcha6W9Nair_zdAnuqxj1dds3ZxuHGTmflRqVsfZ4ny7v8rKOaaHL0MpVqqtYlhU0GUSTyy_JZ7IovrjH7xIyVR-fwtF6mmPpgBgUW9w_VlSUuONvVvTbLRFpP_MD9Ya3x6Bmag70PPcmGrq9nnH1IM1IsbwbyMS1ISiv51aZo5S4Npd89q9srHlBeM41mrlXg9oph55Mv12mLFe7LYk6UqL8JpXpsUxZEGJgqupzDouU8VnjmrMWruu4vM2uZDk3Ab1r1PS0gaVO4NQ7mxMbxzYH1FwTgZQLeP7V8MObo1UwMwVlZPZrowHua1PZatlrWli1XdlNBCknWbZXM_KkeZVRKeyafkEAuBVEoxmVIQzddGEG1MxFa1Y7XQ1ohbKQwz1VUiVGzjGcCY_eaGQ3F6jLoZgIZkrTvFgX6RaCjk_HzBKzSoTZrtT29AuXOEuYegWAymRYCrfb23dbZETqzfOroZgvBdOdcmdg7T_j1BP_IfoplHZI8zdzoG1iA65brbyiilY5j0tM19YDCcRsWFw4fdcAQsxP_DFpxQvbjPlf8rHiMEDaW-PXQlrIhJfj9T5vDP1fgQS4tmnqYG8T2ll07dH52je4z7YumGwoHBhtbdkmGPXBmKYk2OYxNQ1_U-Sx_cOFZLpStWwYH18_0IITC4nJ_nze6yU1BolodVWLQpZnaqTelkf9yeIkOerZG4G-W2U2Cw8OW0cyEG2a1hh0bv58E8G8Fi1R8d-AkXOYEXUT3enLpX7yXok3SZkaU6W8SPzFUPbBvaDH6F8IH5pN3nR5AMu8Dnnhwk0bi9G2pGRq8KqWNNRNHARM8sVsM58A7B62n-x5kt5H-SNtL5AAk0_gv72CNLDT64S-pipXeWN-tNV86_fYlBwPrPe1yhAAB7eixrMVqbOJbyjH04QN7SZX-BISqZZYTb0F2AK1GEVNdLgOcR9_wQDZAnm07_abyFGl--x2Zw3fD_j04d17u0aBgyLQRvc0vLuoogyGUoE6U0_yKRp3EObyYsRbAkcc1_hlh&cid=CAASFeRoqtWErkNJFYL8abrXgoi8ZnfQ8Q&rfl=1%2Chttps%253A%252F%252Fufile.io%252F%240

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b1bc5d5ada6c2c3cee9893c5f04275250efeecb94cc66832fd53cf831f98c01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12882
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 78E8 42 B
63 B 48ms
45ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B9pz0B0bBAevkLKE-akzsRny1Nou8K6CkUCb2ax5bKXZ1hsKZzrt-JMJxvUknOAfHJAS_pF5ZAgiLFxHV1goETwMyjzudgqf1vBg4tmqTLkWqXTag

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/ Frame 78E8 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/window_focus_fy2019.js

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:25:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 264
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Sep 2021 19:25:22 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 78E8 124 KB
37 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be8e3fb00d98e93afe954eb362d24a5d80537eb55c896bba9734e5771b6b34b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:46 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629458990649126"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38246
x-xss-protection: 0
expires: Mon, 23 Aug 2021 19:29:46 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/ Frame 78E8 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:27:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 141
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Sep 2021 19:27:25 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Mon, 23 Aug 2021 19:29:46 GMT

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 5465
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

55ms
54ms

Image
text/html

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Redirect headers

date: Mon, 23 Aug 2021 19:29:46 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9DE4 640 B
316 B 34ms
32ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVJz0Bk-qvwOR8bSce3HLv-ht9-p6IfYI1lPb2r3nQP1HvwDyxKRxJouHL7nssNy2x8HXWQNpUFUTwQfG1ov-M0D3DglfEs8YFy5qpsQsZcpKBofL5g7wnIbt6pOj8FP5fahEVytTEbo7mUrISDcrhb1bpH5YOIRhqFAkHcy3Eg2vVGOt4

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVJz0Bk-qvwOR8bSce3HLv-ht9-p6IfYI1lPb2r3nQP1HvwDyxKRxJouHL7nssNy2x8HXWQNpUFUTwQfG1ov-M0D3DglfEs8YFy5qpsQsZcpKBofL5g7wnIbt6pOj8FP5fahEVytTEbo7mUrISDcrhb1bpH5YOIRhqFAkHcy3Eg2vVGOt4
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmjaPk-2xCBFZ--MWEASttvgkgqj7vxGmdwIKUD2sn6NsSKltzrrHT9OPg0wzw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 23 Aug 2021 19:29:46 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E8A3 24 KB
13 KB 59ms
57ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ApL1o-SK-RNPrBnrYqCieF22gPFajuDPfyQvC-fHYQKGRaqRs-sujSjuCFLuEiBaNzCvSoRCGL5mFNuEfIDkWV0YGXJcifzFRTTzlQSf7X8Bt8VQznx10wc30Iaf-3T8LVKYxzE7hyF0ekIsMd5lV_O5CmyA&cry=1&dbm_d=AKAmf-CjbJBCc0Zn6rAYzyhsYzsQnE1M3kao5VtFWElRlMnwmLwhBKHGllM65FJ2x9cuHiEIWp8W5v0qfNSY8jg-rSUD055F252UKxcuCDSS2RPzEQ5fHcD4RHkcOJaABfODgFNjmijquIWSummNIYZ7HsKToPqshrc_N1Ewd6TQAG4Nh-xQP_-u8DvswUNAjK23vTYkl1p0AY9C4lfp5FD5ReSXFh0ChE2aFCX6c6wxvNwaK4KumHnfj2gcRvadGyMaamrHuBzRkRgQI2mosXEuuh4aIt-BQzk0jb7tXVN0JPmAM5mkb5208K_fGwxBWA3SltGHuRPTyLlFo85Ai_9VXDTxcXj5DbEjb17WUzH5OKdkU7Y9zk3FbRdJdGy8hPckoMPAJzgTpy_PH4e9VPYzgTYQtjpQdsfKf-0C_6vzhyetkhZewbishB45hndwL4POedq__aao_hEpZdykF947ei4UrP00-1NUEcU0DoQ_ABJNSLotkK6fXtcDFPZ-us7jVAJMttFLJVfVcg0VMw8imZ_PE3KS5-moilroMbRH7y0zr0Ya5IRqDRYLZqB9mT4mdkAHKW5IX8ZHc4Me1IIAZru6m0XmDgxsDuPkg-VHY29S0vsf-Df0JrZTo034l1zvJpYzw0U5JuuRRoyu1P69EDY_YEU0aAKU0saBOvj4M4aRzmDITaZ-xtRMW3d2SYQYIDW2pDFycbkBmGayqlxZZpwNXHm2PTd6UfnrpuHd_bDWJ8jfycUelJOl6rR82bf_adsKyDxeksWxQ4ATF5jeId8Ah81L4kDCnSz_2VWKE7FLlC27lWBVumOHjbifEwNz7qza3Pw0fiirEqYJPdO7Qp5ZPPphgHruJNbptF9sYT2nnHrpdFrztjqMIImiPqIU1vKp827ZpEHjLM7tKxbmMViQuQ1GZazCO9uVM_Gc0E9CBOxTZ8LygfYhRVoGwYaZbF6XkQ3QWWsEH7Ds5sy6OfWBOQZQ0BZR_v28AFOAcYPw2U5yM9_-5DaSxGDXNjmsg7ZFImydr0c846WdxEoEiGrt47o7N8xzHRsi_zuRTINjaHFtjlKwLiiU1uoETzCeM71H0Gs2akXsByOuMd8kCTPMI4SdANtLHcx7cAv5RQrP2DTmtOGct4l5GZSP53z1tsn_NTLcZTMmdwz-1JF6dqQ_tON2jK_-aReo4lPZByziAV9_12vgFc0wH8LVRWnWzgROeV4eXTAnnD0zB_MFOuYuRl5sxngHW_OgAH0GQh7OU_JQ_93rbu63ODgU9abuOidY7bcQ8YuCCt3iBs4r-X5_n3yN6IhaPxxq6KB5V_bRlqf293FIY_jTThncD_mD7cIFp6l8GHLwWeahEW829BJ5RThyNPJSDyOVaq3cuan9fABB4ko7fX9r7VOOiC8k7d1Vu1lD3EL8h9E58JNU8BDgZBdo2N-iCxoBf6qY3uJKA1iJ-O6GH177CGAyP6q2CPMvwlt1146PZCm-wXhlssc9CsCuJhjNF4UyDvyM82yzihukPhbaJu3Y4VUZLdMdYn59n5tp2VBGultX3x8DqlpHWfZyVOQy0wmSs5KZ9AOKYbmzKg90qsvI1Mt8rL1pD9QuP4FtoOroPIE3ZZFkuyqLK6gnDKdWomVMWAbX3yn3tg0H2LCrpK7R_uWRh0U6qomeVzRIBm0fr0FwUcYVzRg6bkwZ5O2OfVGZxUc4cB0N845FOH-XGT7wRxIH0thA_oLsDF-6PzN4S7mLe9t8YtD_8NmEQQB2Kwc_woJf7Fp12JPoyXJ0mdNIyPj5ity69_mXsrO2VpPQ0GeHIhBMqXvApRI9gdTjXzYPgGa5iWu5xBpfr1EVrxSJbpxBKS4yL93JT9Rj5arapI46eOiYj2-JmiGM2tZLfFYWMkdcBHRcobZ9eKzKHv33M_AsBkfSMFqBfILckf7nnAdcst_iz_64sUyyM2yRxZ_EKVIvV8HkudbCisSgvjIoRH5vDcnf-Agn5JYg7lClAjnSQD4ZzsjeLcsXANOxhw-BnJXvdJR9z78jB6mvdV6qEg6xzMZcfGjqj-5YyWFc6viHHdGVmllHb_h7B1IlSPOiy1eBT6PwvdwlK3qS3Md1JQJyc8lpT9Axk9dH-IT8C-tYk7DUtkPcMNGXtuBN9R0fy3V5jGLbbc72geEGh_PUe-rwQ3ILcDfuHSrzbbQ5HX3IkwbXmGV7FGFS7OrVlBTBEN9Itr0mFzEev60EdKT3XuM_0WoGYlrcAU8GQB3fBQs-74Xp2lKgOBCkVmdNzKJ5u5LFN8aXyc1ETStgRFWnFsA0VB66sPf0QBajbBXKc9nW4gb1kDA6XkgWb7vdgZCOSyQXHcD_b_UrMDLOUb1wi3Px6C9VOKTTfmSjLfyzs93U2hAEa7wv627t--jNF96lvhJZPULfC0LvQtkmCKYuiFLw-3LPwfQvqVV_8fgGeXVDGk6w7-iGL943i4OZQkTyg8B6Y4RE9DF-Dh6W0dhTBvYJ_yf7iEPVaOfGVOy5X9rpP-_dGj565HnJEt35ipKSq2Au49TFC4ezla0ccjcMuDuAgYMN1jtlMBHYJybr1FIZ-vbzyEV8B8CfYA70WmyJaigNa2gZmOR2_sH7r2bZ8oBf6kWrxBPUEFrN1eRqIXYUw7P-a8o2jMRfM4iwyt1Jq42YAQzouhphovHu9o4imTuU8MvPmQZeP8L9ZmyYo2UQjVZIOtLsGLHkX5dpOVvl8HzcrWeG8OwbKPQ8zlxoaEFcIBWUmQdQBpRmeEcLpoftZtX514pEL5wznscGKBN5XVCtUYa-7yQpnjeDzajg8iuQ9i2yopYLXcUFk7TE7cqegftcfSCmRsuIxBdIqnU9mTU6i8tnQtEr6pusIXE2cPEm0ulTGU7AKHE7OkFy2q4Y-J8u5jKww37KbaUwlzAjlrpEahh1HqTnTzBwf-pANJABkjiCi_u-AVDuwOXRMityeNeah5MF-Twji6Lt3BNYaXqDNq1YBqqRnkNs8oVN71YXWENq6tqSP4naq8bPvFV8YFJYsvyKcS328ztCAw4G2mNiJ5aljarN75JBp8JKYsMWWoBMtaiD5SEidLrBPfMcRTtm0fkXb_FvAcZGcYETTp0YQ24thFZM-2abu1WNqd75h2QFU6S_GHxK&cid=CAASFeRolv9vxbfTYsy6_iyBrZJxcHubBA&rfl=1%2Chttps%253A%252F%252Fufile.io%252F%240

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

09c1a64d7b662844a62ebd35ed5399a070111877ba3fc15bebe6aa498f135c9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12983
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E8A3 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cvdh7RzikzcRb5ThvtnV7aKlAzU1J6TImUmR8OjVPbSQ7qUs-7lPVGEAAQsX-3SvAGGPKkWZSMecPdyG__zFVzDBREMUxUXkZEsJmufUHwquRMaYs

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/ Frame E8A3 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/window_focus_fy2019.js

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:25:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 264
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Sep 2021 19:25:22 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E8A3 124 KB
37 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be8e3fb00d98e93afe954eb362d24a5d80537eb55c896bba9734e5771b6b34b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:46 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629458990649126"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38246
x-xss-protection: 0
expires: Mon, 23 Aug 2021 19:29:46 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/ Frame E8A3 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:27:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 141
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Sep 2021 19:27:25 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame E8A3 0
0 15ms
14ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRLsi1kS48BPeL_zwVnwmKALtvPpOx_QhBCrM-f9BQSyUKMs6FCWHUhrtfI3jvccfZQ9gvMmzSfwceJ7ovcECWGyzm6pw
Requested by: Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame B96E 640 B
316 B 34ms
33ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKSElwEQoKCcARjRtsywATAB&v=APEucNWz4zKlOZUTK151gVMrZHNPZELz9EcicBgzaz54nazEM1VaXD5xAJkv-AP7iGfK62nGzjiL-44sLBLFLLVQVPm1WG9GZp4bUIdcRRisYewc9zoPOM6unUQ02rOJq_ZUS5BxgmzjZ6WBxWnmfIO5cdl0iD3S10IKDYJMAliHxljWRVwnE_E

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKSElwEQoKCcARjRtsywATAB&v=APEucNWz4zKlOZUTK151gVMrZHNPZELz9EcicBgzaz54nazEM1VaXD5xAJkv-AP7iGfK62nGzjiL-44sLBLFLLVQVPm1WG9GZp4bUIdcRRisYewc9zoPOM6unUQ02rOJq_ZUS5BxgmzjZ6WBxWnmfIO5cdl0iD3S10IKDYJMAliHxljWRVwnE_E
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmjaPk-2xCBFZ--MWEASttvgkgqj7vxGmdwIKUD2sn6NsSKltzrrHT9OPg0wzw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 23 Aug 2021 19:29:46 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 32C1 70 KB
28 KB 54ms
52ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AT7pvaKHmim8GuY80Oc-JMF3ujeF6hkQ3KIyASEfLHG9dNfdtSrKfEWI2p9QMz5adOjO9yQMsbxfaD9UYsaza4m2Jusqz_L7ilLzIRKAVFiyTapyDocTVoulLSYkAG-D1OzptShLea4NHhBF3vVrvBEmy60Q&dbm_d=AKAmf-CXX_SjkZn1DvlirK9roBBWEGRITdWBE4158Icp9pN5NE2-F5OIpdwM1qA5hB1396K_E01a2gR9zjzY9uMfV6EPUy4y6jS-MrMVR7vZ0HxsCy-Q7xW8PqXRHMTL-P7WnwKmLOEY35piAQICyRt-5TgqbbLC8c_fNvfAjQwsWTZyrvK-68EjpqFTyaHJI0ZllYiZPjvozC0HlbvX7kPJxURdaeBmTVK3i_cmNEh8YxHVdgxZuKEwoIJ7xq-OxCOD-_bV6mDVavxxKIh4z_awcvAH8Io3URjNKbNS111Phcav2WMt9wwYMcepoEioYiWBVD6tmwXiY7iNsGylxW8V3T5ClxEcriO2v5LoUVWqkKSsGkkHjL7wPGru7X5sVVv_FjVhl2zjElRPEqImBOf3KeuCsEdWrwLBSPUFdUbZ_U6ZVdcpYXy0qMtaC8zcgiIIiplFP3Xx8M5TKwhRXPiH4x7BuufZ3o9sKM3dFih2uGlmvgZhGujXsyv1QDFs9e2lg_azmqd6ZD1FMrjkQByjJwEzKZsLbNS-J5g0O6Lm4RAx_Ze8x6PxMzF3WMzEAveR_2v6KijvHn7agb1kw1g-fdtwb1ou5nVnT5TWNardMdLj4FkZPqjDfMkDD7G8Wn5_V5EiGTAnq8uiwTdSZhX4Sd7SlfAGqgwrHsHAxYmPAwVy5SUJbSgCMbb3e7BfoyuAVBXjYmuxR2-MRS15wOB7rt1Z73SndQ07tGmEZRJ0jodAhxV6njw3o952Ngosgdfb1H_xRCJp4OIhxf5jVIg6F-dqUDR5v5s937R5gtbGAR_zafWL2nZp7Iz_43lgqk48aC5ok5FpBdJSreapvjuimFRu06i9DBtDlWbC59xZHJ6z8oHrEn0QJGRXk6GSS1gFRs_R2K378uMBAzT_CePQxEi9PTMhMUl70XTlLvrPzxxzWvCdDJjxlnxMXZZjO_6Loba1i94hElCEhOqf5wNXqJKatH3ctbEqXGc4YFyG4iH4NU2FmP_dFAvfdOeZMD8O6HRNWVxHBpIdHniOpHgl91LS1Qn8zURmVRGlCIld08Gc3f4eajp-Vs2ssNbkpRoFMvhuCAD_ks4yiIG5Ha8ofT2fWkjK-9j_i_rIVM_k8j3a9kpmLlXnDE_3TGbOR-uutYFD8rvekvnl1IoUPRat3WZ6uB8liSxK9YOQm2nuF5yaPgLmcENDTCUjHxKzTZF4voKBg1bKkgQN3_6chjyfAk9MBjSFzxtIfB3S9lXtCIllM-28o2k-FcQnmBWqA5_DehED4moR-Nx7LMfrGm1OkGPKyBwyosalYNKYk8k0UsD_lOnsK6uIpKPd9_XdNzfgdJE1PI8DaGMlhHLWo1ys91qXFhTIhOK7oFuKOIwW7JopRa3ZUXTy9h9nkAKtNu6TZDit4ahuYMoc80uqiYISS9x47KYJINOU9Hjx1RooR0OVt8HJa4WdDQ5b037IoLUC8mZb1oKdSkK78Lzk4D6bejxVeho_yK7sv0Zb1i3uTCTglZUGbCXgrsDQJn43bkBM5hudoShreJ5tuq_SdWLH_Caf_WUhZbyUB1hrV0UMzRT1gO9X6jrDfoFSSQUuwN94nDuK3OMZF0m-2aiq9MCPQj73nh6RAJToWibSa6YekWvf9B4GpiciAPT1si3t-gmGATTvw7gvh9dl6DziDkryH0KxX2WBDR6rJmOz_8S3PvJiP5zV6v5QA-lveQWXcuFk_4g-s_wpNxaXPuyvZuhdVUcsAff7lMpL567y3q-6mH9RQ4kTExjo0-2mwq_d7-KjHcmIpOFwqnt3OvOKSbWyR0Y48kezln4nhV1HUiBqRHaA-dHmyXACT-AEN6RPWYjqny-brqspkWPfoVRPJe_IvrGyKiLZWJHqUq0aPRSqShlzumsiXAEr-qDBPTCLeh6WuhPZqgMrG3bzkLvJf4tKbqLxW9KZLuUNjDEOhfkkNYtgKLdD3VuqfvhB35rFeJ9DtabfEad35L-DVYxHn2-YS6QC9NsgrtcLScO50P30oZlNfmIyVNplSfWN60g5QKdPW7mZY_-M-hHGF5GsHPNu68kbIyzoWmsFzA_p_0LRY0ojP-bT6yYcDRRI-L57MEUt8GI9q3cAuunPC2FgRzEOT8GN-paahspKXsNYfIdiaBWnb5T24zjkNhhTfnEIX-uU6Joi_QVSdViucGHhZs2KWNCUujwsbsQ_GUycCJgBX_eRC9BAwMbjqEie7ChVDqYMRv09LN39964wKCWBbp9T9LEBlX7EQpH0l-J5BeE2WdUM3GoI-_rEKgaFCnuRt0U4_hSCKLFmvoDNVJ5M4EE2I5cgDEsyVpiRtuf7-M6DDNykfFPKL-SD3CH61VtHU1D4q3egyoz0aPU4F3Fre40k8V7SvYlpiyBmqz4SvLRI8lQgmhIgbmOGRb3g08v2jQfai9EXZh2A8skWf_da_BhM18_u4091aRduOEXletNeLkmONrQAM-p9y7d0WPBr6h2lilZ3QZExafv9Gf4GB8yTAzoZr_MfpORTzK1LSRbXPrlBS0K9qqb9u904zdALibOABR7sEFjwsQD8x2HPukqeQVHZaOqdZMLi4DcraZn8r0raKcIcOD8s-3MFUs4dqQF6uBO8ljhr2529uE0ovRD3uXJ5gRerXYaSgHm5RxbOMT0CJFq4dLipnZ7Lk0kKxqcTd4yxYjcN5ZIV1jlB1lt0rHddjmI_CGreJaELtW_SXHLVLfPnn227cG-pKQ0E4d8yOe67Y5STYhlpW92XoTzkIPoi63-U9Z9aStV1ls4Jfx29QC6CyE65M1BnDB60pkssjM8w6rWf3Vrz9XTt97DGKwRtCpmFXbgx0zesBMOUSDPDoUDDUZaI8FRsRB5ZL_BOzNU09kQOZfYYtdTOrcZNL9qxGQrWNlHJueC0ROiRSwCyR6g5pMy_tTsQ2z5qk1DdG926GxDNTMrOBmBJAYKAey8Ad7DgI1QHCXXLmXRoOCTlHJRV6LK7VQngMJIukSylVtsajsJv2HxEq5md9wa7yDPasFwNOxtICgkTWsl0KnCkbIWzF7gjvfMdXO_O4_W_MTxkPq3jbmqXE7KrYMuCX-_c--dmmTaHOhXY3ee0cGGa4OqoCwu0Z_-_VLMMeokutypyZv6VlVXy7QU3gvJjoF1F6D76Bw&cid=CAASFeRoBRUdunj7RyoCyunJtfU6htydqA&rfl=1%2Chttps%253A%252F%252Fufile.io%252F%240

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

3e6f35da3ba4ac40ae186c263ade4aa69f8a72a1fcc40937e365b327f7c61265

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28406
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 32C1 42 B
63 B 27ms
26ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AE1HEDPPnAA43yiGtZoYllyk6p53gyq7DTXm68odk7SI3eT9Pgql09aStEhUWzuJFde7zroojMgFX9C6HZC2-w0ola4VVGXX9qZqkn2aT0lp67Mfs

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/ Frame 32C1 2 KB
1 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/window_focus_fy2019.js

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:25:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 264
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Sep 2021 19:25:22 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 32C1 124 KB
37 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be8e3fb00d98e93afe954eb362d24a5d80537eb55c896bba9734e5771b6b34b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:46 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629458990649126"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38246
x-xss-protection: 0
expires: Mon, 23 Aug 2021 19:29:46 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/ Frame 32C1 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:27:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 141
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Sep 2021 19:27:25 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5465 2 KB
2 KB 6ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012108100143000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 15:34:33 GMT
x-content-type-options: nosniff
server: cafe
age: 14113
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 24 Aug 2021 15:34:33 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5465 295 B
319 B 6ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012108100143000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 12:37:33 GMT
x-content-type-options: nosniff
server: cafe
age: 24733
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 24 Aug 2021 12:37:33 GMT

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame E30E
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

55ms
54ms

Image
text/html

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Redirect headers

date: Mon, 23 Aug 2021 19:29:46 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E30E 2 KB
2 KB 6ms
5ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012108100143000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 15:34:33 GMT
x-content-type-options: nosniff
server: cafe
age: 14113
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 24 Aug 2021 15:34:33 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E30E 295 B
319 B 6ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012108100143000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 12:37:33 GMT
x-content-type-options: nosniff
server: cafe
age: 24733
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 24 Aug 2021 12:37:33 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/ Frame 78E8 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DMIUypujdfVjJ716osgFNjD5-fCO409Azw5xchhpDRhHudV0vbNgf-W3y6oUWRxjHpGLyxRMfmI_QwZV0fIu2IaX969OfUbbKOe194YKRQ9s37InMiuYaBSBo4hxMUfYaor_R8Y4HNsO-kza3PzQ6sOl9wDw&cry=1&dbm_d=AKAmf-DVSgJLuTFYcKtqBfKHyRTi91O7JuS3mPk2RepEiU1wkyn_YA062Ktv2pZMAVcLoSA74EfZhjiyb2usBnG6GcCrGPZGambDqYOyvrZu1q8iDiiqIuGuZWI4zgxqZRyeM2Rqf1whdeYPB7C2DtCxfUlIPz5GsRNY6kN48GvCevV284tz1w5VhUldrg5EwK6gMGpH6K0nt4owrJg0rd9gNobAFElF8cVnTpv1rgBvHRkUmDTzd1Gf7T1WPrbzNRKfXIsKAkUDv9mestneWX0ZBxT0vLUkP3WSR4OsjPEJaZmH0RLeccS55JuiCfASnoWYwRLe2pOpCOCxC8XJ3Yr9o87qJLlK3jcm0L06I8ZvYojwDzrTi7kgEVfSNng34EwWwGOd4-Eu2epO67azLj2HPkxG2bzi8TC1Yb2as-RH8OfWw6LAkQO7zmr0x22bdvgrdg3pV6HGhrYmMuumfEl3Zm5_zSVEiaFQykaDRegZjX0xHD7w5M80Ks8fg9FEvQJ02ML9S1MZO4uH89G4H0Sn4sVdRAc4brdsacYbM1-YW_kM_tvKjocQiMschPEZMKG5BcMeGx8aC2Q30iKtKeMQk7OuXmVA30-hGVbMZGw6R01KJ2b4NxuxfOshhfK-6OTPWbIQHdiXrGCp6ankyK2cD-ODukN3z7co96qPZBivbl3S6k6JfM_60wUnMHxaqGsuxUchdzrfLhBA389oGe8X7atmCqSDkEVehC3EYOA-pzWTYtgVim2q-XhwtjuBIvXPtgKh14BvVhW7H1AP7LdYk-0if7cocnwDBy1vEY0MPLL30KEL2J2wJWx0p-R96PUbJ4zcl-K8z4RkpY_niJ1uIidDfgYsGkQrYjwyDjtsmS4gaDyYRZSBgwANbenGsNMIBpPrZoCtaU_eLGsbcR1KrjECxH2u4l8INFK_8XZF5T22t502-qyaWNM6LzheJWGyfzS8lXgr2qutuhrkNDzQCB0oLjCP2pGRNh0DEhe-qG0JZxOURXYksPZ_knKDXCezVQRQWil8bS81jaLGDv_IH_5-7SoGOKZcDXutGxnaI0JMJEHnsrzwY8RLpEcmKKv0e2mNxsuB5t0Qp_5ULIXZsw_06D-tA5kxP9eHwQ1XHWLqL8H8uVtJv1RsB3FJp9PLfvNP27OgLqRUy1Mqq9nd95obW79NfYJm_wdBoCK4gTyVorSz3DPbDcHQ4UgvlUWANlKLwOWwLJTSnEdZP0mgo1mUhC2f3Dx78ozo4xDj90xiMSFY0wuyLqyiq8pQ6-ZEeQwukhHC-lghE6tZJDOEpnRMJ5FhrRSsVbYMPUjI3J_fThX3ARlQTCP3NlP7KngAUK3dNTpErWPd8Qu6ef-MtG5qMxKb0aCRK2-8da2hkBkdT0VVyh2C_lctx9Xhd8xt2I4wlBFMq6qsgCTD6h0TGcHmUJscnRP9JaNvX3bUwYfzTUQ-18sjDUFlcdUFHKsgNuLwqSi5xjLw79Yw4wphqfCjF9rUNJc7dxj7ByhaJ7ho31WN8dKWMMxxp39_TLXROJFmxAVl4CfTd9WVGYn55YYqSfjbWUGgPfIV9ss9UsEFEe-NjTUFy9rOlYLRk525uMhEoaebr4FrXB7KOdAIJ1S3js8iKEn7Syqj72ycGT53xFGWX5OpTrIkbwDvBhYMK4-s6PFQTlDkUxYoiqfU0sngJBBE9QMOl6_I2FpGLy2IpNNaSRbToxGMxxoWnxN5Tj5HM-ylAAso_4bhBwpx8wGgmi2mHF1ClBrAvDq1BCLVBIE6RNCEDJ1Y9Mubvesen4grvo3h5huRnkUH0rsJpp2id8cpgONB90g5Zt-H4nZSbb98nzuDz9__PeQusPnT9hzUyH1ClYhWIHeDQd67z5-CAOKYplDRRdW7qwodDZSKF9RDvL_kD-ZV5BTeMCDhfddRmqyce9ZwlbQdwGPss7_92AtuVPv8GnzsS21QJ2gUT0bY3RJTidLtPtuDMlfNKsBCEZONH_v3ILgdIMafH_OvvQgsrVvcNAD0wdYTLF-YJuJSJzPZ1OpI6B3SoUi5iYZcGBsf0GATKES29tQtIxwe8TzYClFvodaXry-eMhA5OTe7s3RCZvmTWKDdUpIcha6W9Nair_zdAnuqxj1dds3ZxuHGTmflRqVsfZ4ny7v8rKOaaHL0MpVqqtYlhU0GUSTyy_JZ7IovrjH7xIyVR-fwtF6mmPpgBgUW9w_VlSUuONvVvTbLRFpP_MD9Ya3x6Bmag70PPcmGrq9nnH1IM1IsbwbyMS1ISiv51aZo5S4Npd89q9srHlBeM41mrlXg9oph55Mv12mLFe7LYk6UqL8JpXpsUxZEGJgqupzDouU8VnjmrMWruu4vM2uZDk3Ab1r1PS0gaVO4NQ7mxMbxzYH1FwTgZQLeP7V8MObo1UwMwVlZPZrowHua1PZatlrWli1XdlNBCknWbZXM_KkeZVRKeyafkEAuBVEoxmVIQzddGEG1MxFa1Y7XQ1ohbKQwz1VUiVGzjGcCY_eaGQ3F6jLoZgIZkrTvFgX6RaCjk_HzBKzSoTZrtT29AuXOEuYegWAymRYCrfb23dbZETqzfOroZgvBdOdcmdg7T_j1BP_IfoplHZI8zdzoG1iA65brbyiilY5j0tM19YDCcRsWFw4fdcAQsxP_DFpxQvbjPlf8rHiMEDaW-PXQlrIhJfj9T5vDP1fgQS4tmnqYG8T2ll07dH52je4z7YumGwoHBhtbdkmGPXBmKYk2OYxNQ1_U-Sx_cOFZLpStWwYH18_0IITC4nJ_nze6yU1BolodVWLQpZnaqTelkf9yeIkOerZG4G-W2U2Cw8OW0cyEG2a1hh0bv58E8G8Fi1R8d-AkXOYEXUT3enLpX7yXok3SZkaU6W8SPzFUPbBvaDH6F8IH5pN3nR5AMu8Dnnhwk0bi9G2pGRq8KqWNNRNHARM8sVsM58A7B62n-x5kt5H-SNtL5AAk0_gv72CNLDT64S-pipXeWN-tNV86_fYlBwPrPe1yhAAB7eixrMVqbOJbyjH04QN7SZX-BISqZZYTb0F2AK1GEVNdLgOcR9_wQDZAnm07_abyFGl--x2Zw3fD_j04d17u0aBgyLQRvc0vLuoogyGUoE6U0_yKRp3EObyYsRbAkcc1_hlh&cid=CAASFeRoqtWErkNJFYL8abrXgoi8ZnfQ8Q&rfl=1%2Chttps%253A%252F%252Fufile.io%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:24:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 306
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9341
x-xss-protection: 0
server: cafe
etag: 177112232901409761
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Sep 2021 19:24:40 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 78E8 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 18:55:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2040
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 23 Aug 2022 18:55:46 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame A7BE 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ufile.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ufile.io/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Mon, 23 Aug 2021 18:55:49 GMT
expires: Tue, 23 Aug 2022 18:55:49 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2037
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 2836 783 B
535 B 17ms
17ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

52e62d5f34b1f43219f4423a095094765cdcb4528ec3225faa3103108dd202b6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-mu2AB8UqTPv4JTBjMhsW+g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ufile.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ufile.io/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 23 Aug 2021 19:29:46 GMT
date: Mon, 23 Aug 2021 19:29:46 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-mu2AB8UqTPv4JTBjMhsW+g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 13B0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEjlnBi3046pnRoP2GiUx-Y&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEjlnBi3046pnRoP2GiUx-Y&google_cver=1&C=1

43 B
1014 B

38ms
38ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEjlnBi3046pnRoP2GiUx-Y&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVT7Ms0o7A-aHsNpZhcaUyQTI712FHxV-c2zLHC_cgAeMWR1HphwCk4xvsDefmqA3pOgrAxaHtTS6kGIqfNdd4zEKWHzmbKUTLp6lcuEaJGQYAJ50Z0jJlIJTMZm4SNusqD3oP72TDMfmBIzQhrQgfPii6Ifqadd1wUOmuQ_5MzQhUeq0w
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:46 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 23 Aug 2021 19:29:46 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:46 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEjlnBi3046pnRoP2GiUx-Y&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Mon, 23 Aug 2021 19:29:46 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 13B0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YSP3Ku-t4Pxsht6O.eMWQwAA
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm=&google_hm=YSP3Ku-t4Pxsht6O.eMWQwAA&google_tc=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPuCveD4KzqzKuhlJg1k9qQ&google_cver=1&google_hm=2

43 B
894 B

38ms
35ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPuCveD4KzqzKuhlJg1k9qQ&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVT7Ms0o7A-aHsNpZhcaUyQTI712FHxV-c2zLHC_cgAeMWR1HphwCk4xvsDefmqA3pOgrAxaHtTS6kGIqfNdd4zEKWHzmbKUTLp6lcuEaJGQYAJ50Z0jJlIJTMZm4SNusqD3oP72TDMfmBIzQhrQgfPii6Ifqadd1wUOmuQ_5MzQhUeq0w
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:46 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 23 Aug 2021 19:29:46 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPuCveD4KzqzKuhlJg1k9qQ&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 13B0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIccmybS4NEbxNPQG4Ubi9c&google_cver=1

43 B
1006 B

18ms
17ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIccmybS4NEbxNPQG4Ubi9c&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVT7Ms0o7A-aHsNpZhcaUyQTI712FHxV-c2zLHC_cgAeMWR1HphwCk4xvsDefmqA3pOgrAxaHtTS6kGIqfNdd4zEKWHzmbKUTLp6lcuEaJGQYAJ50Z0jJlIJTMZm4SNusqD3oP72TDMfmBIzQhrQgfPii6Ifqadd1wUOmuQ_5MzQhUeq0w

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:46 GMT
X-Proxy-Origin: 213.232.87.179; 213.232.87.179; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 79d70547-db30-42ae-b447-cc9db4adb8af
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIccmybS4NEbxNPQG4Ubi9c&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 13B0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU2OTUxMTcxNjExMzYyNTU1Mg%3D%3D

170 B
188 B

62ms
31ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU2OTUxMTcxNjExMzYyNTU1Mg%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:46 GMT
X-Proxy-Origin: 213.232.87.179; 213.232.87.179; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 75eccab6-d8de-4e3e-9403-d5caa65f5fac
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjU2OTUxMTcxNjExMzYyNTU1Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 32C1 114 KB
40 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 23:04:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73512
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 23 Aug 2021 23:04:34 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/elements/html/ Frame 32C1 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AT7pvaKHmim8GuY80Oc-JMF3ujeF6hkQ3KIyASEfLHG9dNfdtSrKfEWI2p9QMz5adOjO9yQMsbxfaD9UYsaza4m2Jusqz_L7ilLzIRKAVFiyTapyDocTVoulLSYkAG-D1OzptShLea4NHhBF3vVrvBEmy60Q&dbm_d=AKAmf-CXX_SjkZn1DvlirK9roBBWEGRITdWBE4158Icp9pN5NE2-F5OIpdwM1qA5hB1396K_E01a2gR9zjzY9uMfV6EPUy4y6jS-MrMVR7vZ0HxsCy-Q7xW8PqXRHMTL-P7WnwKmLOEY35piAQICyRt-5TgqbbLC8c_fNvfAjQwsWTZyrvK-68EjpqFTyaHJI0ZllYiZPjvozC0HlbvX7kPJxURdaeBmTVK3i_cmNEh8YxHVdgxZuKEwoIJ7xq-OxCOD-_bV6mDVavxxKIh4z_awcvAH8Io3URjNKbNS111Phcav2WMt9wwYMcepoEioYiWBVD6tmwXiY7iNsGylxW8V3T5ClxEcriO2v5LoUVWqkKSsGkkHjL7wPGru7X5sVVv_FjVhl2zjElRPEqImBOf3KeuCsEdWrwLBSPUFdUbZ_U6ZVdcpYXy0qMtaC8zcgiIIiplFP3Xx8M5TKwhRXPiH4x7BuufZ3o9sKM3dFih2uGlmvgZhGujXsyv1QDFs9e2lg_azmqd6ZD1FMrjkQByjJwEzKZsLbNS-J5g0O6Lm4RAx_Ze8x6PxMzF3WMzEAveR_2v6KijvHn7agb1kw1g-fdtwb1ou5nVnT5TWNardMdLj4FkZPqjDfMkDD7G8Wn5_V5EiGTAnq8uiwTdSZhX4Sd7SlfAGqgwrHsHAxYmPAwVy5SUJbSgCMbb3e7BfoyuAVBXjYmuxR2-MRS15wOB7rt1Z73SndQ07tGmEZRJ0jodAhxV6njw3o952Ngosgdfb1H_xRCJp4OIhxf5jVIg6F-dqUDR5v5s937R5gtbGAR_zafWL2nZp7Iz_43lgqk48aC5ok5FpBdJSreapvjuimFRu06i9DBtDlWbC59xZHJ6z8oHrEn0QJGRXk6GSS1gFRs_R2K378uMBAzT_CePQxEi9PTMhMUl70XTlLvrPzxxzWvCdDJjxlnxMXZZjO_6Loba1i94hElCEhOqf5wNXqJKatH3ctbEqXGc4YFyG4iH4NU2FmP_dFAvfdOeZMD8O6HRNWVxHBpIdHniOpHgl91LS1Qn8zURmVRGlCIld08Gc3f4eajp-Vs2ssNbkpRoFMvhuCAD_ks4yiIG5Ha8ofT2fWkjK-9j_i_rIVM_k8j3a9kpmLlXnDE_3TGbOR-uutYFD8rvekvnl1IoUPRat3WZ6uB8liSxK9YOQm2nuF5yaPgLmcENDTCUjHxKzTZF4voKBg1bKkgQN3_6chjyfAk9MBjSFzxtIfB3S9lXtCIllM-28o2k-FcQnmBWqA5_DehED4moR-Nx7LMfrGm1OkGPKyBwyosalYNKYk8k0UsD_lOnsK6uIpKPd9_XdNzfgdJE1PI8DaGMlhHLWo1ys91qXFhTIhOK7oFuKOIwW7JopRa3ZUXTy9h9nkAKtNu6TZDit4ahuYMoc80uqiYISS9x47KYJINOU9Hjx1RooR0OVt8HJa4WdDQ5b037IoLUC8mZb1oKdSkK78Lzk4D6bejxVeho_yK7sv0Zb1i3uTCTglZUGbCXgrsDQJn43bkBM5hudoShreJ5tuq_SdWLH_Caf_WUhZbyUB1hrV0UMzRT1gO9X6jrDfoFSSQUuwN94nDuK3OMZF0m-2aiq9MCPQj73nh6RAJToWibSa6YekWvf9B4GpiciAPT1si3t-gmGATTvw7gvh9dl6DziDkryH0KxX2WBDR6rJmOz_8S3PvJiP5zV6v5QA-lveQWXcuFk_4g-s_wpNxaXPuyvZuhdVUcsAff7lMpL567y3q-6mH9RQ4kTExjo0-2mwq_d7-KjHcmIpOFwqnt3OvOKSbWyR0Y48kezln4nhV1HUiBqRHaA-dHmyXACT-AEN6RPWYjqny-brqspkWPfoVRPJe_IvrGyKiLZWJHqUq0aPRSqShlzumsiXAEr-qDBPTCLeh6WuhPZqgMrG3bzkLvJf4tKbqLxW9KZLuUNjDEOhfkkNYtgKLdD3VuqfvhB35rFeJ9DtabfEad35L-DVYxHn2-YS6QC9NsgrtcLScO50P30oZlNfmIyVNplSfWN60g5QKdPW7mZY_-M-hHGF5GsHPNu68kbIyzoWmsFzA_p_0LRY0ojP-bT6yYcDRRI-L57MEUt8GI9q3cAuunPC2FgRzEOT8GN-paahspKXsNYfIdiaBWnb5T24zjkNhhTfnEIX-uU6Joi_QVSdViucGHhZs2KWNCUujwsbsQ_GUycCJgBX_eRC9BAwMbjqEie7ChVDqYMRv09LN39964wKCWBbp9T9LEBlX7EQpH0l-J5BeE2WdUM3GoI-_rEKgaFCnuRt0U4_hSCKLFmvoDNVJ5M4EE2I5cgDEsyVpiRtuf7-M6DDNykfFPKL-SD3CH61VtHU1D4q3egyoz0aPU4F3Fre40k8V7SvYlpiyBmqz4SvLRI8lQgmhIgbmOGRb3g08v2jQfai9EXZh2A8skWf_da_BhM18_u4091aRduOEXletNeLkmONrQAM-p9y7d0WPBr6h2lilZ3QZExafv9Gf4GB8yTAzoZr_MfpORTzK1LSRbXPrlBS0K9qqb9u904zdALibOABR7sEFjwsQD8x2HPukqeQVHZaOqdZMLi4DcraZn8r0raKcIcOD8s-3MFUs4dqQF6uBO8ljhr2529uE0ovRD3uXJ5gRerXYaSgHm5RxbOMT0CJFq4dLipnZ7Lk0kKxqcTd4yxYjcN5ZIV1jlB1lt0rHddjmI_CGreJaELtW_SXHLVLfPnn227cG-pKQ0E4d8yOe67Y5STYhlpW92XoTzkIPoi63-U9Z9aStV1ls4Jfx29QC6CyE65M1BnDB60pkssjM8w6rWf3Vrz9XTt97DGKwRtCpmFXbgx0zesBMOUSDPDoUDDUZaI8FRsRB5ZL_BOzNU09kQOZfYYtdTOrcZNL9qxGQrWNlHJueC0ROiRSwCyR6g5pMy_tTsQ2z5qk1DdG926GxDNTMrOBmBJAYKAey8Ad7DgI1QHCXXLmXRoOCTlHJRV6LK7VQngMJIukSylVtsajsJv2HxEq5md9wa7yDPasFwNOxtICgkTWsl0KnCkbIWzF7gjvfMdXO_O4_W_MTxkPq3jbmqXE7KrYMuCX-_c--dmmTaHOhXY3ee0cGGa4OqoCwu0Z_-_VLMMeokutypyZv6VlVXy7QU3gvJjoF1F6D76Bw&cid=CAASFeRoBRUdunj7RyoCyunJtfU6htydqA&rfl=1%2Chttps%253A%252F%252Fufile.io%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Sep 2021 19:29:30 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/ Frame 32C1 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:24:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 306
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9341
x-xss-protection: 0
server: cafe
etag: 177112232901409761
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Sep 2021 19:24:40 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/ Frame E8A3 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ApL1o-SK-RNPrBnrYqCieF22gPFajuDPfyQvC-fHYQKGRaqRs-sujSjuCFLuEiBaNzCvSoRCGL5mFNuEfIDkWV0YGXJcifzFRTTzlQSf7X8Bt8VQznx10wc30Iaf-3T8LVKYxzE7hyF0ekIsMd5lV_O5CmyA&cry=1&dbm_d=AKAmf-CjbJBCc0Zn6rAYzyhsYzsQnE1M3kao5VtFWElRlMnwmLwhBKHGllM65FJ2x9cuHiEIWp8W5v0qfNSY8jg-rSUD055F252UKxcuCDSS2RPzEQ5fHcD4RHkcOJaABfODgFNjmijquIWSummNIYZ7HsKToPqshrc_N1Ewd6TQAG4Nh-xQP_-u8DvswUNAjK23vTYkl1p0AY9C4lfp5FD5ReSXFh0ChE2aFCX6c6wxvNwaK4KumHnfj2gcRvadGyMaamrHuBzRkRgQI2mosXEuuh4aIt-BQzk0jb7tXVN0JPmAM5mkb5208K_fGwxBWA3SltGHuRPTyLlFo85Ai_9VXDTxcXj5DbEjb17WUzH5OKdkU7Y9zk3FbRdJdGy8hPckoMPAJzgTpy_PH4e9VPYzgTYQtjpQdsfKf-0C_6vzhyetkhZewbishB45hndwL4POedq__aao_hEpZdykF947ei4UrP00-1NUEcU0DoQ_ABJNSLotkK6fXtcDFPZ-us7jVAJMttFLJVfVcg0VMw8imZ_PE3KS5-moilroMbRH7y0zr0Ya5IRqDRYLZqB9mT4mdkAHKW5IX8ZHc4Me1IIAZru6m0XmDgxsDuPkg-VHY29S0vsf-Df0JrZTo034l1zvJpYzw0U5JuuRRoyu1P69EDY_YEU0aAKU0saBOvj4M4aRzmDITaZ-xtRMW3d2SYQYIDW2pDFycbkBmGayqlxZZpwNXHm2PTd6UfnrpuHd_bDWJ8jfycUelJOl6rR82bf_adsKyDxeksWxQ4ATF5jeId8Ah81L4kDCnSz_2VWKE7FLlC27lWBVumOHjbifEwNz7qza3Pw0fiirEqYJPdO7Qp5ZPPphgHruJNbptF9sYT2nnHrpdFrztjqMIImiPqIU1vKp827ZpEHjLM7tKxbmMViQuQ1GZazCO9uVM_Gc0E9CBOxTZ8LygfYhRVoGwYaZbF6XkQ3QWWsEH7Ds5sy6OfWBOQZQ0BZR_v28AFOAcYPw2U5yM9_-5DaSxGDXNjmsg7ZFImydr0c846WdxEoEiGrt47o7N8xzHRsi_zuRTINjaHFtjlKwLiiU1uoETzCeM71H0Gs2akXsByOuMd8kCTPMI4SdANtLHcx7cAv5RQrP2DTmtOGct4l5GZSP53z1tsn_NTLcZTMmdwz-1JF6dqQ_tON2jK_-aReo4lPZByziAV9_12vgFc0wH8LVRWnWzgROeV4eXTAnnD0zB_MFOuYuRl5sxngHW_OgAH0GQh7OU_JQ_93rbu63ODgU9abuOidY7bcQ8YuCCt3iBs4r-X5_n3yN6IhaPxxq6KB5V_bRlqf293FIY_jTThncD_mD7cIFp6l8GHLwWeahEW829BJ5RThyNPJSDyOVaq3cuan9fABB4ko7fX9r7VOOiC8k7d1Vu1lD3EL8h9E58JNU8BDgZBdo2N-iCxoBf6qY3uJKA1iJ-O6GH177CGAyP6q2CPMvwlt1146PZCm-wXhlssc9CsCuJhjNF4UyDvyM82yzihukPhbaJu3Y4VUZLdMdYn59n5tp2VBGultX3x8DqlpHWfZyVOQy0wmSs5KZ9AOKYbmzKg90qsvI1Mt8rL1pD9QuP4FtoOroPIE3ZZFkuyqLK6gnDKdWomVMWAbX3yn3tg0H2LCrpK7R_uWRh0U6qomeVzRIBm0fr0FwUcYVzRg6bkwZ5O2OfVGZxUc4cB0N845FOH-XGT7wRxIH0thA_oLsDF-6PzN4S7mLe9t8YtD_8NmEQQB2Kwc_woJf7Fp12JPoyXJ0mdNIyPj5ity69_mXsrO2VpPQ0GeHIhBMqXvApRI9gdTjXzYPgGa5iWu5xBpfr1EVrxSJbpxBKS4yL93JT9Rj5arapI46eOiYj2-JmiGM2tZLfFYWMkdcBHRcobZ9eKzKHv33M_AsBkfSMFqBfILckf7nnAdcst_iz_64sUyyM2yRxZ_EKVIvV8HkudbCisSgvjIoRH5vDcnf-Agn5JYg7lClAjnSQD4ZzsjeLcsXANOxhw-BnJXvdJR9z78jB6mvdV6qEg6xzMZcfGjqj-5YyWFc6viHHdGVmllHb_h7B1IlSPOiy1eBT6PwvdwlK3qS3Md1JQJyc8lpT9Axk9dH-IT8C-tYk7DUtkPcMNGXtuBN9R0fy3V5jGLbbc72geEGh_PUe-rwQ3ILcDfuHSrzbbQ5HX3IkwbXmGV7FGFS7OrVlBTBEN9Itr0mFzEev60EdKT3XuM_0WoGYlrcAU8GQB3fBQs-74Xp2lKgOBCkVmdNzKJ5u5LFN8aXyc1ETStgRFWnFsA0VB66sPf0QBajbBXKc9nW4gb1kDA6XkgWb7vdgZCOSyQXHcD_b_UrMDLOUb1wi3Px6C9VOKTTfmSjLfyzs93U2hAEa7wv627t--jNF96lvhJZPULfC0LvQtkmCKYuiFLw-3LPwfQvqVV_8fgGeXVDGk6w7-iGL943i4OZQkTyg8B6Y4RE9DF-Dh6W0dhTBvYJ_yf7iEPVaOfGVOy5X9rpP-_dGj565HnJEt35ipKSq2Au49TFC4ezla0ccjcMuDuAgYMN1jtlMBHYJybr1FIZ-vbzyEV8B8CfYA70WmyJaigNa2gZmOR2_sH7r2bZ8oBf6kWrxBPUEFrN1eRqIXYUw7P-a8o2jMRfM4iwyt1Jq42YAQzouhphovHu9o4imTuU8MvPmQZeP8L9ZmyYo2UQjVZIOtLsGLHkX5dpOVvl8HzcrWeG8OwbKPQ8zlxoaEFcIBWUmQdQBpRmeEcLpoftZtX514pEL5wznscGKBN5XVCtUYa-7yQpnjeDzajg8iuQ9i2yopYLXcUFk7TE7cqegftcfSCmRsuIxBdIqnU9mTU6i8tnQtEr6pusIXE2cPEm0ulTGU7AKHE7OkFy2q4Y-J8u5jKww37KbaUwlzAjlrpEahh1HqTnTzBwf-pANJABkjiCi_u-AVDuwOXRMityeNeah5MF-Twji6Lt3BNYaXqDNq1YBqqRnkNs8oVN71YXWENq6tqSP4naq8bPvFV8YFJYsvyKcS328ztCAw4G2mNiJ5aljarN75JBp8JKYsMWWoBMtaiD5SEidLrBPfMcRTtm0fkXb_FvAcZGcYETTp0YQ24thFZM-2abu1WNqd75h2QFU6S_GHxK&cid=CAASFeRolv9vxbfTYsy6_iyBrZJxcHubBA&rfl=1%2Chttps%253A%252F%252Fufile.io%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:24:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 306
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9341
x-xss-protection: 0
server: cafe
etag: 177112232901409761
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Sep 2021 19:24:40 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E8A3 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 18:55:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2040
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 23 Aug 2022 18:55:46 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 9DE4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1

43 B
172 B

23ms
22ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVJz0Bk-qvwOR8bSce3HLv-ht9-p6IfYI1lPb2r3nQP1HvwDyxKRxJouHL7nssNy2x8HXWQNpUFUTwQfG1ov-M0D3DglfEs8YFy5qpsQsZcpKBofL5g7wnIbt6pOj8FP5fahEVytTEbo7mUrISDcrhb1bpH5YOIRhqFAkHcy3Eg2vVGOt4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.214.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
via: 1.1 google
server: OXGW/16.214.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1
date: Mon, 23 Aug 2021 19:29:46 GMT
via: 1.1 google
server: OXGW/16.214.0
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9DE4
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmVmNDAzMzUtMGU0ZC0yMzNlLWM2ZjctNmEzZmUzOTVlYzkx
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmVmNDAzMzUtMGU0ZC0yMzNlLWM2ZjctNmEzZmUzOTVlYzkx&google_tc=

170 B
188 B

33ms
32ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmVmNDAzMzUtMGU0ZC0yMzNlLWM2ZjctNmEzZmUzOTVlYzkx&google_tc=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVJz0Bk-qvwOR8bSce3HLv-ht9-p6IfYI1lPb2r3nQP1HvwDyxKRxJouHL7nssNy2x8HXWQNpUFUTwQfG1ov-M0D3DglfEs8YFy5qpsQsZcpKBofL5g7wnIbt6pOj8FP5fahEVytTEbo7mUrISDcrhb1bpH5YOIRhqFAkHcy3Eg2vVGOt4

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmVmNDAzMzUtMGU0ZC0yMzNlLWM2ZjctNmEzZmUzOTVlYzkx&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 9DE4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESECUR0I-UZ0YH5o5u_gMfrSw&google_cver=1

23 B
172 B

49ms
49ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESECUR0I-UZ0YH5o5u_gMfrSw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVJz0Bk-qvwOR8bSce3HLv-ht9-p6IfYI1lPb2r3nQP1HvwDyxKRxJouHL7nssNy2x8HXWQNpUFUTwQfG1ov-M0D3DglfEs8YFy5qpsQsZcpKBofL5g7wnIbt6pOj8FP5fahEVytTEbo7mUrISDcrhb1bpH5YOIRhqFAkHcy3Eg2vVGOt4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 23 Aug 2021 19:29:46 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESECUR0I-UZ0YH5o5u_gMfrSw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 9DE4 23 B
172 B 107ms
48ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvp61PTAB&v=APEucNVJz0Bk-qvwOR8bSce3HLv-ht9-p6IfYI1lPb2r3nQP1HvwDyxKRxJouHL7nssNy2x8HXWQNpUFUTwQfG1ov-M0D3DglfEs8YFy5qpsQsZcpKBofL5g7wnIbt6pOj8FP5fahEVytTEbo7mUrISDcrhb1bpH5YOIRhqFAkHcy3Eg2vVGOt4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 23 Aug 2021 19:29:46 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame B96E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1

43 B
106 B

22ms
22ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKSElwEQoKCcARjRtsywATAB&v=APEucNWz4zKlOZUTK151gVMrZHNPZELz9EcicBgzaz54nazEM1VaXD5xAJkv-AP7iGfK62nGzjiL-44sLBLFLLVQVPm1WG9GZp4bUIdcRRisYewc9zoPOM6unUQ02rOJq_ZUS5BxgmzjZ6WBxWnmfIO5cdl0iD3S10IKDYJMAliHxljWRVwnE_E
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.214.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
via: 1.1 google
server: OXGW/16.214.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESECZZSuqM9KG8VZ7wBozQynU&google_cver=1
date: Mon, 23 Aug 2021 19:29:46 GMT
via: 1.1 google
server: OXGW/16.214.0
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B96E
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Mzg2MDM0NjgtMzAwYi0yMmM1LWQxNTgtNmI3NWVmZTA5MmQ2
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Mzg2MDM0NjgtMzAwYi0yMmM1LWQxNTgtNmI3NWVmZTA5MmQ2&google_tc=

170 B
188 B

32ms
31ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Mzg2MDM0NjgtMzAwYi0yMmM1LWQxNTgtNmI3NWVmZTA5MmQ2&google_tc=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKSElwEQoKCcARjRtsywATAB&v=APEucNWz4zKlOZUTK151gVMrZHNPZELz9EcicBgzaz54nazEM1VaXD5xAJkv-AP7iGfK62nGzjiL-44sLBLFLLVQVPm1WG9GZp4bUIdcRRisYewc9zoPOM6unUQ02rOJq_ZUS5BxgmzjZ6WBxWnmfIO5cdl0iD3S10IKDYJMAliHxljWRVwnE_E

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Mzg2MDM0NjgtMzAwYi0yMmM1LWQxNTgtNmI3NWVmZTA5MmQ2&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame B96E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESECUR0I-UZ0YH5o5u_gMfrSw&google_cver=1

23 B
172 B

49ms
49ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESECUR0I-UZ0YH5o5u_gMfrSw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKSElwEQoKCcARjRtsywATAB&v=APEucNWz4zKlOZUTK151gVMrZHNPZELz9EcicBgzaz54nazEM1VaXD5xAJkv-AP7iGfK62nGzjiL-44sLBLFLLVQVPm1WG9GZp4bUIdcRRisYewc9zoPOM6unUQ02rOJq_ZUS5BxgmzjZ6WBxWnmfIO5cdl0iD3S10IKDYJMAliHxljWRVwnE_E
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 23 Aug 2021 19:29:46 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESECUR0I-UZ0YH5o5u_gMfrSw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame B96E 23 B
172 B 103ms
50ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKSElwEQoKCcARjRtsywATAB&v=APEucNWz4zKlOZUTK151gVMrZHNPZELz9EcicBgzaz54nazEM1VaXD5xAJkv-AP7iGfK62nGzjiL-44sLBLFLLVQVPm1WG9GZp4bUIdcRRisYewc9zoPOM6unUQ02rOJq_ZUS5BxgmzjZ6WBxWnmfIO5cdl0iD3S10IKDYJMAliHxljWRVwnE_E
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 23 Aug 2021 19:29:46 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

GET
DATA 200
OK truncated
/ 881 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9c8faba32cf813d34a373a7528d2446d0f2b061f8dd6900391af20ac718f69bd

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 34B8 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 23 Aug 2021 18:55:46 GMT
expires: Tue, 23 Aug 2022 18:55:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2040
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK u1k7uwfcgkn1 Show response
hal9000.redintelligence.net/zone/ Frame 78E8 11 KB
4 KB 106ms
32ms Script
text/html 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/u1k7uwfcgkn1?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAqnFKfcjYbGtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_Q6p7-TJlJDNl76TbL2kwKYTpmbx0XeEU87dKGjd3btHHnekbE6V2tXuD-t3KJ5oPm2TfcZmgraoYkBiG1evoHRD5nMreBX0Uh5O03nt9mXmaRE8rl9SArnWRvsLWnsxfbHIbhzFy_zvZyb94fV_uHTr1H6RXzAxJDu2TaKImhDAqf7dS9KdKYaXoGSquJTcWEJ5KQbQK0oDIPKrqsZTzMH4_xx5lhNkZeHGruJc3LuI_gH0vgktqtGb9wbcATmiVyC9paou6QxP9UwQ6w7r3jK-pDyT9wYjLABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoqtWErkNJFYL8abrXgoi8ZnfQ8Q%26sig%3DAOD64_0mG4Z30cBe7iWnjQ87MUNs02a4mQ%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-B4pcDUwBbK3t_448c2as49MMMS8rUeE1iJfYiOsTtQWlrXIUVfr449ZJrVaEDeeeqvsF0DP7oB6DF5V_I4VIOOxd83XNdRFv2G7zNuXVODiM5x88UxRADVuOthwY-JrFjZFFQ9Dv2fqT6x2N0ZlGAzyBVx-Q%26cry%3D1%26dbm_d%3DAKAmf-B9dvv_XJWopkRmopIsNufgam2SAMDKD3pw1GrEC4SELTOukb7ZfSBtFYUJE_K9BXxajoq9Dx4KsnondjtCqeqR5BSQ3CdVQoKbRHVLKuYaJDhJeYlJRjoUu7HGzMQ0qqOSJ6aOXpYZQZgSsHnZmWQB4v6lYZ66XsP4Rd3PS3fOMa_HmXqEOPCQjhT1dn1e_Ee6vS_92LzjZpnGz13VROSHSQov291AuPJUfF4Y0kP05yK6yiOgcOLE0ocfOVhr5GQUGpCI_6pPjOk_dVXGAG1nrg1LrdXLmY18QPrYjEPNpDR6Az_vYiDbClbjMNBHH3hyPcrr9J0QL7DtmQnA35xV4g4hecGGn8RpA7mPFUWRRV3FDPmA2Ue1GaN0SdxKZPR30bc07FqcfYtiiHkWIIoZ4cmVRFzM3cjAMbX0RV0_sbv3r4RFk-zj2XrIlr3-XPBO03Ki%26adurl%3D
Requested by: Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 0c52f7015c565b13167f52309eb741f8e2288ef6653bc3b9cd75893407500a24

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 23 Aug 2021 19:29:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3890
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 327E 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 23 Aug 2021 18:55:46 GMT
expires: Tue, 23 Aug 2022 18:55:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2040
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 32C1 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 18:55:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2040
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 23 Aug 2022 18:55:46 GMT

GET
DATA 200
OK truncated
/ Frame 32C1 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8f152dd85f3a9209d7d061d2f80a87d259413629ac793dc1093e40543f915ae7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK u1k7uwfcgkn1 Show response
hal9000.redintelligence.net/zone/ Frame E8A3 11 KB
4 KB 94ms
33ms Script
text/html 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/u1k7uwfcgkn1?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZ60KfcjYbCtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_QLD9jwJXQFNQABi0ySzcKbI-BrP7Bn2NycgaJjCBCmKanaawFwYe_dLHnq6PdZZL_dcIeL9NpL7L7SBK37-K1IVDZnsPltQYe4Ueo3YjpKQGVDdZtl_h5lxdE073Q2c4a5tV33UaNme1wqnbHGOS2hEvFLs93h3e-KsvnvIFKAaE9iUBUXVj2W3z-WPzQLTwvm_W34yqnnFPL4x_qSpywsju2oCNWXYQ5Eb_rn3TVs1l0fzVnTVnEAqLyvHQrbFav2wIY-orOZKUy0DLgACHc8ODQls_-GRDABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRolv9vxbfTYsy6_iyBrZJxcHubBA%26sig%3DAOD64_1olfucxqgZ5xozkqle6zk2UCQ1AA%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-DAG1vZkE1zNrOZnWcgRriqMZ0b7UrsrDOb6HveYDdfvZ152dX8I_7QxmALftOi0FVlV8vV6IjLPeqm8BGLR0Y-YAdF8904b2Tg4gvxEWUVYdyhRTVGLy2qHUM5arIxD6ePbRB7VYegFhANLTJPrqHHhEgFFA%26cry%3D1%26dbm_d%3DAKAmf-BNVP-FZJwF1PtlPGDLSQJCcNaOMGCyteptIxFKR0qRJcX1_rs-1_GYB8eevGyy2ng5ERnNfxW33a_vEyy2On1K3_-B0lieSeBcj1c6VoNKzmQidkr_I2RKfoUH9tdW88CFSrEJJyfVvpTA021kdHa0M8BybDhnbw-ZKf3ju00aR8Ib8cMV6VAttKmeyQUIVF3SM9C5HMwNSsP0tn7OFSWGvqbYrrLyj4DJlYHBzsOzn-0YxrkSRvMr4alnOcQFtScDsRzWOH_FTQVILhvSzp6B-eN03pfQBHs8mfVxHo0DCVWCkZv_-f4ZVC7bSSX_OHoJ2JchU29hnByjOYrAe0h8_TS9xdeBY4fbr4a1_1krc77T8LGyuFiCjB-uYLUrFPgnSIZCA3denOT2Sq2mPnRj4tPRApJhpTXTUUFNJfZAg1GjaySnqPn2pTnOWLjislN6jWSX%26adurl%3D
Requested by: Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 1f67a2d6eb0d330f4d74d49ae193e7073cfda5d34fcf3ffdbe7c3c0dea8cc58f

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 23 Aug 2021 19:29:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3887
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 index.html Show response
s0.2mdn.net/8483882/1626446224307/ Frame 2791 4 KB
2 KB 8ms
6ms Document
text/html 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8483882/1626446224307/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c69c0dea0450a6dc3447508a0567e7ad976b5dfb5dc58df66f65729ea0451270

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /8483882/1626446224307/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 1731
date: Mon, 23 Aug 2021 05:09:48 GMT
expires: Tue, 24 Aug 2021 05:09:48 GMT
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=86400
age: 51598
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 32C1 0
592 B 103ms
50ms Ping
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstXoFNrUzw3T59EL7M5RLTU2N48ZTur4fImkzme3_0SYkNUbYWrf6WqaR9IrDQZ8dnIGIQbA0YdyrWUxhsjQ1E-EJQBT1H_Alhg8LTZxZxRZ3I3C3zr0vJltkcNihaDMKxiTEaey3-7zcDhM6saMFylFXO86p_Uk7kXhSyXfQWxWq5B9arHOAZ0ouGFdZVS6DZ57_BQwz72HDAFVwK_Fel0KF7ZkO5RGV2m0TnTSqnG1KH7RdkkiajL0VfDnhA16N9ZbKdi_KloweSHEU0mVAv0ojsO7NqMTP3Jsihp4tntN2wZX1J98KiNYMqX9SS9BFXQWapRLbh1tLlzNzq2CLXjanx1KKLfuDRvjaCxRI7rCrQbWnt6hHFZe8vEhy0U3-_SR3rWa2r4OOh_VFYwUAco209R1qjX4RxUZ6bHv-QEXjgMQ1RjHlF3yUQVsKfQKqFJbXOAmOkd6DDxNi6lwFEJroH3pQ4HNI42tsITK3yzuw9pJjMFN1jHdMLvRbO9j6kFwTNzmK-7irh89nMKKLlk9rYls52VT9hcsYlQIjWP6bcMEfeaaebX-4ylTMe1fpkN3X5lkFIyESmc_vniuQvLcGiG788BTlyLPV8CSaNA2g1WcdjL4FqS5MQZxxx32lL4-xUBog796HZV3iQu_5FHFCzeXMJgFXyYS_ELOdrL3Wlq20KYOhYyhm9aPbVGG9dEeoACWv0qE5mztoQVxSFrI39OQzV6Yc8D5bKvm6k4_MZTi_TjZ2FtIdHxbT-oeuIGoDZ8IkO4OkvN960qpQdCy-EtfGZ1qGYBPF7OYJB64uIP8a4Torh1J80b3BwnEUSUIzReFhxOmBGcrxzAmx9GoXC5csrz2g5yi04FAnZghTNvw1ihNDV2PdwSE_v9mazQporZEdvcTaIBxCEDOKCKQQnBtS-xf0x8ry4WjFRG77Xz0o1PYpKCaHlUboblRLI00Sv6O_hF6x6GgP7qS_nOrQit6sYLXSRtIm60sLc-A6pKv1WFWq_rsfmIEXXF02jVABpYh8TrTq4Lq5I9wsI5E63y45lH6InAQIOVO_6mdOwiVqO0kAX6astNBNOVAK8UHpNoH0Cq6RQxbGIw5fY1U5aKnIOzeDgIGC7quN9jfNCt5KxrWEcGwm3gb76FhuExczBWcQu0szslttH_FYgllfxbLN3b7XCP9hx6izVjY3nNGOc&sai=AMfl-YQcPtfZiptokkNLLVgxXc68Jyc0669cm5y-XGElbL4UJOn9KxntLMOITApsEgi9sCLxGbIY8EbIQcVE1GvVapeL7pcMMurz8HDrFd7KxqjlLT5Ficv0e7xXY8s3gN9OJ72jehT1UNhDmstvQvbtpUkqBmQrDAPv2nHmY5s&sig=Cg0ArKJSzHKAvYlUu8hGEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=123&cbvp=1&cstd=121&cisv=r20210816.31762&adurl=

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 23 Aug 2021 19:29:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 61DD 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 23 Aug 2021 18:55:46 GMT
expires: Tue, 23 Aug 2022 18:55:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2040
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js Show response
pagead2.googlesyndication.com/bg/ Frame A7BE 35 KB
13 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6e0cf33bd31faca2542d9376cc2a8b9722904e24cc4d3bfc121048e46c244ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 11:26:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28974
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13303
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 23 Aug 2022 11:26:52 GMT

GET
H2 200 1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js Show response
pagead2.googlesyndication.com/bg/ Frame 34B8 35 KB
13 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6e0cf33bd31faca2542d9376cc2a8b9722904e24cc4d3bfc121048e46c244ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 11:26:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28974
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13303
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 23 Aug 2022 11:26:52 GMT

GET
H2 200 LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js Show response
pagead2.googlesyndication.com/bg/ Frame 327E 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 15:24:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14735
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13273
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 23 Aug 2022 15:24:11 GMT

GET
H3-29 200 lottie.min.js Show response
s0.2mdn.net/8483882/1626446224307/ Frame 2791 256 KB
64 KB 24ms
7ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8483882/1626446224307/lottie.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8483882/1626446224307/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f601e5ffcbdccd40c8485bd0be0ae1cb3c419fc18e7b7eeb5ff085652a0a870

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51597
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65619
x-xss-protection: 0
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 24 Aug 2021 05:09:49 GMT

GET
H3-29 200 LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js Show response
pagead2.googlesyndication.com/bg/ Frame 61DD 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 15:24:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14735
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13273
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 23 Aug 2022 15:24:11 GMT

GET
H/1.1

200
OK

request.php Show response
hal900024.redintelligence.net/ Frame 78E8
Redirect Chain

https://hal900024.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=c3b4c1f80a&subid=&uid=953a653ff5bce91d&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900024.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=c3b4c1f80a&subid=&uid=953a653ff5bce91d&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

3 KB
2 KB

145ms
84ms

Script
application/x-javascript

138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=c3b4c1f80a&subid=&uid=953a653ff5bce91d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAqnFKfcjYbGtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_Q6p7-TJlJDNl76TbL2kwKYTpmbx0XeEU87dKGjd3btHHnekbE6V2tXuD-t3KJ5oPm2TfcZmgraoYkBiG1evoHRD5nMreBX0Uh5O03nt9mXmaRE8rl9SArnWRvsLWnsxfbHIbhzFy_zvZyb94fV_uHTr1H6RXzAxJDu2TaKImhDAqf7dS9KdKYaXoGSquJTcWEJ5KQbQK0oDIPKrqsZTzMH4_xx5lhNkZeHGruJc3LuI_gH0vgktqtGb9wbcATmiVyC9paou6QxP9UwQ6w7r3jK-pDyT9wYjLABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoqtWErkNJFYL8abrXgoi8ZnfQ8Q%26sig%3DAOD64_0mG4Z30cBe7iWnjQ87MUNs02a4mQ%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-B4pcDUwBbK3t_448c2as49MMMS8rUeE1iJfYiOsTtQWlrXIUVfr449ZJrVaEDeeeqvsF0DP7oB6DF5V_I4VIOOxd83XNdRFv2G7zNuXVODiM5x88UxRADVuOthwY-JrFjZFFQ9Dv2fqT6x2N0ZlGAzyBVx-Q%26cry%3D1%26dbm_d%3DAKAmf-B9dvv_XJWopkRmopIsNufgam2SAMDKD3pw1GrEC4SELTOukb7ZfSBtFYUJE_K9BXxajoq9Dx4KsnondjtCqeqR5BSQ3CdVQoKbRHVLKuYaJDhJeYlJRjoUu7HGzMQ0qqOSJ6aOXpYZQZgSsHnZmWQB4v6lYZ66XsP4Rd3PS3fOMa_HmXqEOPCQjhT1dn1e_Ee6vS_92LzjZpnGz13VROSHSQov291AuPJUfF4Y0kP05yK6yiOgcOLE0ocfOVhr5GQUGpCI_6pPjOk_dVXGAG1nrg1LrdXLmY18QPrYjEPNpDR6Az_vYiDbClbjMNBHH3hyPcrr9J0QL7DtmQnA35xV4g4hecGGn8RpA7mPFUWRRV3FDPmA2Ue1GaN0SdxKZPR30bc07FqcfYtiiHkWIIoZ4cmVRFzM3cjAMbX0RV0_sbv3r4RFk-zj2XrIlr3-XPBO03Ki%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=1595731836652&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 59fefd903d714cb8bfc6bcabe7d29723af5b20530998895c1796de004872ef1f

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:46 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 98116500199684200719604011695024
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1127
Expires: Mon, 23 Aug 2021 20:29:46 +0200

Redirect headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:46 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=c3b4c1f80a&subid=&uid=953a653ff5bce91d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAqnFKfcjYbGtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_Q6p7-TJlJDNl76TbL2kwKYTpmbx0XeEU87dKGjd3btHHnekbE6V2tXuD-t3KJ5oPm2TfcZmgraoYkBiG1evoHRD5nMreBX0Uh5O03nt9mXmaRE8rl9SArnWRvsLWnsxfbHIbhzFy_zvZyb94fV_uHTr1H6RXzAxJDu2TaKImhDAqf7dS9KdKYaXoGSquJTcWEJ5KQbQK0oDIPKrqsZTzMH4_xx5lhNkZeHGruJc3LuI_gH0vgktqtGb9wbcATmiVyC9paou6QxP9UwQ6w7r3jK-pDyT9wYjLABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoqtWErkNJFYL8abrXgoi8ZnfQ8Q%26sig%3DAOD64_0mG4Z30cBe7iWnjQ87MUNs02a4mQ%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-B4pcDUwBbK3t_448c2as49MMMS8rUeE1iJfYiOsTtQWlrXIUVfr449ZJrVaEDeeeqvsF0DP7oB6DF5V_I4VIOOxd83XNdRFv2G7zNuXVODiM5x88UxRADVuOthwY-JrFjZFFQ9Dv2fqT6x2N0ZlGAzyBVx-Q%26cry%3D1%26dbm_d%3DAKAmf-B9dvv_XJWopkRmopIsNufgam2SAMDKD3pw1GrEC4SELTOukb7ZfSBtFYUJE_K9BXxajoq9Dx4KsnondjtCqeqR5BSQ3CdVQoKbRHVLKuYaJDhJeYlJRjoUu7HGzMQ0qqOSJ6aOXpYZQZgSsHnZmWQB4v6lYZ66XsP4Rd3PS3fOMa_HmXqEOPCQjhT1dn1e_Ee6vS_92LzjZpnGz13VROSHSQov291AuPJUfF4Y0kP05yK6yiOgcOLE0ocfOVhr5GQUGpCI_6pPjOk_dVXGAG1nrg1LrdXLmY18QPrYjEPNpDR6Az_vYiDbClbjMNBHH3hyPcrr9J0QL7DtmQnA35xV4g4hecGGn8RpA7mPFUWRRV3FDPmA2Ue1GaN0SdxKZPR30bc07FqcfYtiiHkWIIoZ4cmVRFzM3cjAMbX0RV0_sbv3r4RFk-zj2XrIlr3-XPBO03Ki%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=1595731836652&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 23 Aug 2021 20:29:46 +0200

GET
H3-29 200 PVPS_Touch_970_250.json Show response
s0.2mdn.net/8483882/1626446224307/ Frame 2791 58 KB
9 KB 7ms
6ms XHR
application/json 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8483882/1626446224307/PVPS_Touch_970_250.json

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8483882/1626446224307/lottie.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d869180dcc114985416a2264e5bb8f7c3b80c17d9b8352319b39242a2d77c2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51597
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8879
x-xss-protection: 0
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 24 Aug 2021 05:09:49 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 32C1 0
23 B 75ms
46ms Ping
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: ufile.io
URL: https://ufile.io/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 23 Aug 2021 19:29:46 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

request.php Show response
hal900014.redintelligence.net/ Frame E8A3
Redirect Chain

https://hal900014.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=942122184e&subid=&uid=d985a6384a5be65a&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900014.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=942122184e&subid=&uid=d985a6384a5be65a&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

3 KB
2 KB

155ms
94ms

Script
application/x-javascript

176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=942122184e&subid=&uid=d985a6384a5be65a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZ60KfcjYbCtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_QLD9jwJXQFNQABi0ySzcKbI-BrP7Bn2NycgaJjCBCmKanaawFwYe_dLHnq6PdZZL_dcIeL9NpL7L7SBK37-K1IVDZnsPltQYe4Ueo3YjpKQGVDdZtl_h5lxdE073Q2c4a5tV33UaNme1wqnbHGOS2hEvFLs93h3e-KsvnvIFKAaE9iUBUXVj2W3z-WPzQLTwvm_W34yqnnFPL4x_qSpywsju2oCNWXYQ5Eb_rn3TVs1l0fzVnTVnEAqLyvHQrbFav2wIY-orOZKUy0DLgACHc8ODQls_-GRDABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRolv9vxbfTYsy6_iyBrZJxcHubBA%26sig%3DAOD64_1olfucxqgZ5xozkqle6zk2UCQ1AA%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-DAG1vZkE1zNrOZnWcgRriqMZ0b7UrsrDOb6HveYDdfvZ152dX8I_7QxmALftOi0FVlV8vV6IjLPeqm8BGLR0Y-YAdF8904b2Tg4gvxEWUVYdyhRTVGLy2qHUM5arIxD6ePbRB7VYegFhANLTJPrqHHhEgFFA%26cry%3D1%26dbm_d%3DAKAmf-BNVP-FZJwF1PtlPGDLSQJCcNaOMGCyteptIxFKR0qRJcX1_rs-1_GYB8eevGyy2ng5ERnNfxW33a_vEyy2On1K3_-B0lieSeBcj1c6VoNKzmQidkr_I2RKfoUH9tdW88CFSrEJJyfVvpTA021kdHa0M8BybDhnbw-ZKf3ju00aR8Ib8cMV6VAttKmeyQUIVF3SM9C5HMwNSsP0tn7OFSWGvqbYrrLyj4DJlYHBzsOzn-0YxrkSRvMr4alnOcQFtScDsRzWOH_FTQVILhvSzp6B-eN03pfQBHs8mfVxHo0DCVWCkZv_-f4ZVC7bSSX_OHoJ2JchU29hnByjOYrAe0h8_TS9xdeBY4fbr4a1_1krc77T8LGyuFiCjB-uYLUrFPgnSIZCA3denOT2Sq2mPnRj4tPRApJhpTXTUUFNJfZAg1GjaySnqPn2pTnOWLjislN6jWSX%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=9519821447074&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: b8e82c5b550ed0e2f547d9d9f0b53cbe363bef7aa067dec27e7285feb96b2f25

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:46 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 33897200160697300719604011695014
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1005
Expires: Mon, 23 Aug 2021 20:29:46 +0200

Redirect headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:46 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=942122184e&subid=&uid=d985a6384a5be65a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZ60KfcjYbCtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_QLD9jwJXQFNQABi0ySzcKbI-BrP7Bn2NycgaJjCBCmKanaawFwYe_dLHnq6PdZZL_dcIeL9NpL7L7SBK37-K1IVDZnsPltQYe4Ueo3YjpKQGVDdZtl_h5lxdE073Q2c4a5tV33UaNme1wqnbHGOS2hEvFLs93h3e-KsvnvIFKAaE9iUBUXVj2W3z-WPzQLTwvm_W34yqnnFPL4x_qSpywsju2oCNWXYQ5Eb_rn3TVs1l0fzVnTVnEAqLyvHQrbFav2wIY-orOZKUy0DLgACHc8ODQls_-GRDABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRolv9vxbfTYsy6_iyBrZJxcHubBA%26sig%3DAOD64_1olfucxqgZ5xozkqle6zk2UCQ1AA%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-DAG1vZkE1zNrOZnWcgRriqMZ0b7UrsrDOb6HveYDdfvZ152dX8I_7QxmALftOi0FVlV8vV6IjLPeqm8BGLR0Y-YAdF8904b2Tg4gvxEWUVYdyhRTVGLy2qHUM5arIxD6ePbRB7VYegFhANLTJPrqHHhEgFFA%26cry%3D1%26dbm_d%3DAKAmf-BNVP-FZJwF1PtlPGDLSQJCcNaOMGCyteptIxFKR0qRJcX1_rs-1_GYB8eevGyy2ng5ERnNfxW33a_vEyy2On1K3_-B0lieSeBcj1c6VoNKzmQidkr_I2RKfoUH9tdW88CFSrEJJyfVvpTA021kdHa0M8BybDhnbw-ZKf3ju00aR8Ib8cMV6VAttKmeyQUIVF3SM9C5HMwNSsP0tn7OFSWGvqbYrrLyj4DJlYHBzsOzn-0YxrkSRvMr4alnOcQFtScDsRzWOH_FTQVILhvSzp6B-eN03pfQBHs8mfVxHo0DCVWCkZv_-f4ZVC7bSSX_OHoJ2JchU29hnByjOYrAe0h8_TS9xdeBY4fbr4a1_1krc77T8LGyuFiCjB-uYLUrFPgnSIZCA3denOT2Sq2mPnRj4tPRApJhpTXTUUFNJfZAg1GjaySnqPn2pTnOWLjislN6jWSX%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=9519821447074&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 23 Aug 2021 20:29:46 +0200

GET
H3-29 200 img_0.png
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 18 KB
18 KB 9ms
8ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/img_0.png

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1367dfba35126724bf4765c569f3234ebba8732d74e66298e51d81528b3d8df2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18313
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 img_1.png
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 6 KB
6 KB 8ms
7ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/img_1.png

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44b7269e43dd9eb0f9d9ed2a4cf1168952a04760a580770ba9fe63bab404d7f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5811
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 img_2.png
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 1 KB
1 KB 9ms
8ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/img_2.png

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85bf998720b7201c5b6fbb37000409255a0fbc01b2bc3fd73284a5adcf03fdf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1394
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 img_3.png
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 3 KB
3 KB 9ms
8ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/img_3.png

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

38c2584d849164b805bbdf61c420f5ffe53bdbe05adaef33c8de7cc666214ba8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:05 GMT
server: sffe
age: 51596
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3391
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 img_4.png
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 27 KB
27 KB 12ms
10ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/img_4.png

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e2c4a8f092ff7e0787ff317c5e1ee91303a2de7525dd135ba54a0729d4a154e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:05 GMT
server: sffe
age: 51596
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27176
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 img_5.png
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 17 KB
17 KB 18ms
15ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/img_5.png

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8854f3ecb6bc4f68d307982e8f6980d17ed2b310d7c20a868bb52a64ac4bf7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17033
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 img_6.png
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 80 KB
80 KB 14ms
11ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/img_6.png

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c29d0fa59c3e46e73f80349598bf71d74931616380548b99ecce9c62e2649c76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 81921
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_0.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 58 KB
58 KB 16ms
13ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_0.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb7b7d190694be38113cca0c23988163a6842884615e6747d8454705df595a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:05 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 58946
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_1.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 58 KB
58 KB 16ms
14ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_1.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9eae0720c8e0e12bfea3cf3e7322a012311bf0f5cb0d2e2bf857ba103a78356a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59480
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_2.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 59 KB
59 KB 35ms
33ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_2.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3f65a89dbf3af6e8998b716ef0579aedf1a720e291b79cce0eeca562c942611

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60566
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_3.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 59 KB
59 KB 35ms
32ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_3.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

033a754a6c4ba7a1936aaf2900779acd566654b3e0970d692b4562e17a516cd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:05 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60568
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_4.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 58 KB
59 KB 34ms
31ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_4.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84b1598d2645074dc6424dcb649eeca54a6338c0ce2441e566446b0f1d3f3b49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59899
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_5.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 60 KB
60 KB 35ms
33ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_5.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c02be760adaeca6998e8083cbfb8ce3211c1e85ddf2dbea761af93d466d3e04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61545
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_6.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 65 KB
65 KB 25ms
23ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_6.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ec353765ddc9d5dd78a4d2793230422167859a3ff53a621f4e331bf917f7a39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66473
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_7.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 68 KB
68 KB 36ms
34ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_7.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1160e4ff88cc798e2b5bcc562c0d49c30144f3965732c59c4b23ef4390ed593f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69884
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_8.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 72 KB
72 KB 24ms
22ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_8.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea03f86b5795d0be9e7cd0202cf1d812a235e2f3a65c94eb8aeeba969c4fe309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:05 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73649
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_9.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 71 KB
71 KB 20ms
18ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_9.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50b0450ce37b28ff538d906f1ca621a949a7f13d8e34a60d0b57b0cac242f7dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72586
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_10.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 67 KB
67 KB 23ms
22ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_10.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2438cb43d06bd78bbae85448e2f97affe9055d702aef781ba9e46600dbee3e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:05 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 68662
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_11.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 62 KB
62 KB 20ms
19ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_11.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e976c7ad0b882096e7409c97a8dfa372133d37092f3ed0b1fbde9b7438b4c97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63773
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_12.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 63 KB
63 KB 21ms
20ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_12.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20ad052d59599bc9dc8a415a5084fa67a357c4a3299c6a9d22110341b6878b55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64328
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_13.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 63 KB
63 KB 18ms
17ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_13.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9703693a96f36ad0ead95114c9618d405cbf5697c0e5c1499ed45b4d0115837d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64185
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_14.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 62 KB
62 KB 22ms
21ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_14.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01870582b641874e601eafe6cd402f3631131ca1863366468e99e015247825e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:04 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63854
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H3-29 200 seq_0_15.jpg
s0.2mdn.net/8483882/1626446224307/images/ Frame 2791 62 KB
62 KB 17ms
16ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1626446224307/images/seq_0_15.jpg

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df1d622945677aae49846a481ecb65660fad66aecc8d278011484ed477e30952

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1626446224307/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 05:09:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Jul 2021 14:37:05 GMT
server: sffe
age: 51596
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63164
x-xss-protection: 0
expires: Tue, 24 Aug 2021 05:09:50 GMT

GET
H/1.1

200
OK

Cookie set cshow.php Show response
www.zenaps.com/ Frame F224
Redirect Chain

https://www.awin1.com/cshow.php?s=2882174&v=8508&q=413151&r=235229&pref1=98116500199684200719604011695024&pv=1
https://www.zenaps.com/cshow.php?pvr=79bc9041-0448-11ec-a5ea-692d04ef6a29&v=8508&r=235229&q=413151&s=2882174&viewref=98116500199684200719604011695024&pv=1

43 B
704 B

54ms
53ms

Document
image/gif

104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zenaps.com/cshow.php?pvr=79bc9041-0448-11ec-a5ea-692d04ef6a29&v=8508&r=235229&q=413151&s=2882174&viewref=98116500199684200719604011695024&pv=1

Requested by

Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=c3b4c1f80a&subid=&uid=953a653ff5bce91d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAqnFKfcjYbGtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_Q6p7-TJlJDNl76TbL2kwKYTpmbx0XeEU87dKGjd3btHHnekbE6V2tXuD-t3KJ5oPm2TfcZmgraoYkBiG1evoHRD5nMreBX0Uh5O03nt9mXmaRE8rl9SArnWRvsLWnsxfbHIbhzFy_zvZyb94fV_uHTr1H6RXzAxJDu2TaKImhDAqf7dS9KdKYaXoGSquJTcWEJ5KQbQK0oDIPKrqsZTzMH4_xx5lhNkZeHGruJc3LuI_gH0vgktqtGb9wbcATmiVyC9paou6QxP9UwQ6w7r3jK-pDyT9wYjLABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoqtWErkNJFYL8abrXgoi8ZnfQ8Q%26sig%3DAOD64_0mG4Z30cBe7iWnjQ87MUNs02a4mQ%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-B4pcDUwBbK3t_448c2as49MMMS8rUeE1iJfYiOsTtQWlrXIUVfr449ZJrVaEDeeeqvsF0DP7oB6DF5V_I4VIOOxd83XNdRFv2G7zNuXVODiM5x88UxRADVuOthwY-JrFjZFFQ9Dv2fqT6x2N0ZlGAzyBVx-Q%26cry%3D1%26dbm_d%3DAKAmf-B9dvv_XJWopkRmopIsNufgam2SAMDKD3pw1GrEC4SELTOukb7ZfSBtFYUJE_K9BXxajoq9Dx4KsnondjtCqeqR5BSQ3CdVQoKbRHVLKuYaJDhJeYlJRjoUu7HGzMQ0qqOSJ6aOXpYZQZgSsHnZmWQB4v6lYZ66XsP4Rd3PS3fOMa_HmXqEOPCQjhT1dn1e_Ee6vS_92LzjZpnGz13VROSHSQov291AuPJUfF4Y0kP05yK6yiOgcOLE0ocfOVhr5GQUGpCI_6pPjOk_dVXGAG1nrg1LrdXLmY18QPrYjEPNpDR6Az_vYiDbClbjMNBHH3hyPcrr9J0QL7DtmQnA35xV4g4hecGGn8RpA7mPFUWRRV3FDPmA2Ue1GaN0SdxKZPR30bc07FqcfYtiiHkWIIoZ4cmVRFzM3cjAMbX0RV0_sbv3r4RFk-zj2XrIlr3-XPBO03Ki%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=1595731836652&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Host: www.zenaps.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: awpv9247=235229|1629746986|79bd7aa0-0448-11ec-9723-692d00a25ac2; awpv8361=235229|1629746986|79bc9040-0448-11ec-a5ea-692d04ef6a29; awpv19227=235229|1629746986|79c96180-0448-11ec-9723-692d00a25ac2; AWSESS=409216:2841812
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Content-Type: image/gif
Expires: 0
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Pragma: no-cache
Content-Length: 43
Date: Mon, 23 Aug 2021 19:29:47 GMT
Connection: keep-alive
Set-Cookie: awpv8508=235229|1629746986|79bc9041-0448-11ec-a5ea-692d04ef6a29;domain=.zenaps.com;path=/;expires=Tuesday, 24-Aug-2021 19:29:46 UTC;Secure;SameSite=None AWSESS=413151:2882174;domain=.zenaps.com;path=/;Secure;SameSite=None
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

Redirect headers

Location: https://www.zenaps.com/cshow.php?pvr=79bc9041-0448-11ec-a5ea-692d04ef6a29&v=8508&r=235229&q=413151&s=2882174&viewref=98116500199684200719604011695024&pv=1
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Content-Length: 0
Date: Mon, 23 Aug 2021 19:29:47 GMT
Connection: keep-alive
Set-Cookie: awpv8508=235229|1629746986|79bc9041-0448-11ec-a5ea-692d04ef6a29;domain=.awin1.com;path=/;expires=Tuesday, 24-Aug-2021 19:29:46 UTC;Secure;SameSite=None AWSESS=413151:2882174;domain=.awin1.com;path=/;Secure;SameSite=None
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

GET
H/1.1

200
OK

Cookie set cshow.php Show response
www.zenaps.com/ Frame BB13
Redirect Chain

https://www.awin1.com/cshow.php?s=2824569&v=9247&q=407742&r=235229&pref1=98116500199684200719604011695024&pv=1
https://www.zenaps.com/cshow.php?pvr=79bd7aa0-0448-11ec-9723-692d00a25ac2&v=9247&r=235229&q=407742&s=2824569&viewref=98116500199684200719604011695024&pv=1

43 B
705 B

103ms
54ms

Document
image/gif

104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zenaps.com/cshow.php?pvr=79bd7aa0-0448-11ec-9723-692d00a25ac2&v=9247&r=235229&q=407742&s=2824569&viewref=98116500199684200719604011695024&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Host: www.zenaps.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Content-Type: image/gif
Expires: 0
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Pragma: no-cache
Content-Length: 43
Date: Mon, 23 Aug 2021 19:29:46 GMT
Connection: keep-alive
Set-Cookie: awpv9247=235229|1629746986|79bd7aa0-0448-11ec-9723-692d00a25ac2;domain=.zenaps.com;path=/;expires=Thursday, 26-Aug-2021 19:29:46 UTC;Secure;SameSite=None AWSESS=407742:2824569;domain=.zenaps.com;path=/;Secure;SameSite=None
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

Redirect headers

Location: https://www.zenaps.com/cshow.php?pvr=79bd7aa0-0448-11ec-9723-692d00a25ac2&v=9247&r=235229&q=407742&s=2824569&viewref=98116500199684200719604011695024&pv=1
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Content-Length: 0
Date: Mon, 23 Aug 2021 19:29:46 GMT
Connection: keep-alive
Set-Cookie: awpv9247=235229|1629746986|79bd7aa0-0448-11ec-9723-692d00a25ac2;domain=.awin1.com;path=/;expires=Thursday, 26-Aug-2021 19:29:46 UTC;Secure;SameSite=None AWSESS=407742:2824569;domain=.awin1.com;path=/;Secure;SameSite=None
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 78E8 442 B
923 B 126ms
62ms Script
text/javascript 108.128.25.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=98116500199684200719604011695024&t=js&wid=tt-169691
Requested by: Host: ufile.io
URL: https://ufile.io/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.128.25.216 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-108-128-25-216.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d6e58e15d1ba473482af846586fa3edea99b157d9473b7e036675098c019150d

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:46 GMT
cache-control: no-cache, must-revalidate
expires: Mon, 26 Jul 1997 05:00:00 GMT
server: nginx
content-type: text/javascript; charset=UTF-8

GET
H/1.1 200
OK request_content.php Show response
hal900024.redintelligence.net/ Frame 9074 7 KB
2 KB 92ms
31ms Document
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request_content.php?s=98116500199684200719604011695024&a=0befc47b
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=c3b4c1f80a&subid=&uid=953a653ff5bce91d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAqnFKfcjYbGtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_Q6p7-TJlJDNl76TbL2kwKYTpmbx0XeEU87dKGjd3btHHnekbE6V2tXuD-t3KJ5oPm2TfcZmgraoYkBiG1evoHRD5nMreBX0Uh5O03nt9mXmaRE8rl9SArnWRvsLWnsxfbHIbhzFy_zvZyb94fV_uHTr1H6RXzAxJDu2TaKImhDAqf7dS9KdKYaXoGSquJTcWEJ5KQbQK0oDIPKrqsZTzMH4_xx5lhNkZeHGruJc3LuI_gH0vgktqtGb9wbcATmiVyC9paou6QxP9UwQ6w7r3jK-pDyT9wYjLABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoqtWErkNJFYL8abrXgoi8ZnfQ8Q%26sig%3DAOD64_0mG4Z30cBe7iWnjQ87MUNs02a4mQ%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-B4pcDUwBbK3t_448c2as49MMMS8rUeE1iJfYiOsTtQWlrXIUVfr449ZJrVaEDeeeqvsF0DP7oB6DF5V_I4VIOOxd83XNdRFv2G7zNuXVODiM5x88UxRADVuOthwY-JrFjZFFQ9Dv2fqT6x2N0ZlGAzyBVx-Q%26cry%3D1%26dbm_d%3DAKAmf-B9dvv_XJWopkRmopIsNufgam2SAMDKD3pw1GrEC4SELTOukb7ZfSBtFYUJE_K9BXxajoq9Dx4KsnondjtCqeqR5BSQ3CdVQoKbRHVLKuYaJDhJeYlJRjoUu7HGzMQ0qqOSJ6aOXpYZQZgSsHnZmWQB4v6lYZ66XsP4Rd3PS3fOMa_HmXqEOPCQjhT1dn1e_Ee6vS_92LzjZpnGz13VROSHSQov291AuPJUfF4Y0kP05yK6yiOgcOLE0ocfOVhr5GQUGpCI_6pPjOk_dVXGAG1nrg1LrdXLmY18QPrYjEPNpDR6Az_vYiDbClbjMNBHH3hyPcrr9J0QL7DtmQnA35xV4g4hecGGn8RpA7mPFUWRRV3FDPmA2Ue1GaN0SdxKZPR30bc07FqcfYtiiHkWIIoZ4cmVRFzM3cjAMbX0RV0_sbv3r4RFk-zj2XrIlr3-XPBO03Ki%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=1595731836652&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f89a25dd9b6dd0097ef4c92e0f1a4cd5e333ef435a68368b3934b82466cc3507

Request headers

Host: hal900024.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=adad0144cf148ad3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

Date: Mon, 23 Aug 2021 19:29:46 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Mon, 23 Aug 2021 20:29:46 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2138
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

cshow.php
www.zenaps.com/ Frame 78E8
Redirect Chain

https://www.awin1.com/cshow.php?s=2898042&v=8361&q=383360&r=235229&pref1=98116500199684200719604011695024&pv=1
https://www.zenaps.com/cshow.php?pvr=79bc9040-0448-11ec-a5ea-692d04ef6a29&v=8361&r=235229&q=383360&s=2898042&viewref=98116500199684200719604011695024&pv=1

43 B
706 B

117ms
58ms

Image
image/gif

104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zenaps.com/cshow.php?pvr=79bc9040-0448-11ec-a5ea-692d04ef6a29&v=8361&r=235229&q=383360&s=2898042&viewref=98116500199684200719604011695024&pv=1

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:46 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

Redirect headers

Date: Mon, 23 Aug 2021 19:29:46 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Location: https://www.zenaps.com/cshow.php?pvr=79bc9040-0448-11ec-a5ea-692d04ef6a29&v=8361&r=235229&q=383360&s=2898042&viewref=98116500199684200719604011695024&pv=1
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Length: 0

GET
DATA 200
OK truncated
/ Frame 78E8 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0425a19aff98033be59c3fcc1c2f03a4dda5c88696303e8e7503e07caa4c8aa3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021081901&jk=4211425590730756&bg=!FhWlFVHNAAZvV8FTb1c7ACkAdvg8WndDsxwGXCrd-oaN_joF7gs5JJ7pK8J01AWK94-z6pXboQ1e7AIAAAFyUgAAACloAQeZAmTkMSbUC4l3cBpn-q0W19WlnVg3IwuniNFajxRlWn7D1f-_B3cKciKhR9467AHQgmiytuSeeTCbBHgWscgigBY91Akv-WbljpY3W1KRDx72ml4a3scxitBx1aMmcfH4gzTNoCmm5fXv4edLYLSDL08a4F4_9J_v1xqmFREVUCbPollKdjbNyR_BvD4KQSz13TG2Z1ryc7UsCO8cHARITlJxyapzWuuLuxSymCIxzhbwqoyejbCjFWbb0mDSZdoG3WwOY5_ghDd65dX46raOezngmNXMQsRmYv5stKFEtha8wtWLBszLiYZm9vrPzBEdtyD6zZ6jgU6POkjvRDU7nYDf_nDRd5GPiYeQxBjq1WbHUuNlRrjTchiYglKHEDpfZjZy6UxJu4bLRF-vmIkNWUZnSZ3ZiJjql5tMB5eurl1Es7E2KZxHHp_Cui58KcNWrKAtGK8OhNNe2X35qz7QR_LXsP2hegjpkDm7oWISfDYc1ucVHCJJxJxn9zsd3xMaRYE28Xbqa13RInWUFgnwQLy4r1bxYZGwUIFlb-71WjRU-gGnRJtvwJV2fiVE5YKcUh7c1UqPgPc6xjAG98R2VNf_px7JPsvhlJmPsTEq82F5JTw3lkzrWKFveDCTb_8MtUnI-0pvy3fhLWJiyCbFS1Uc8qnUywH9BuFqeJODhDjKcMhfYIDJ6gDNdMPaHfrJhTdr8UnVqLxJrluL3zmNnShDgiNEU_dNOTRdvDSTGigdfg60yKJQpwbUNzkULcCVyQbBeZxAWqNRRDcXDSwc68_ZooPpb2yq25zzXZZZoW0by-pLzUQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 34B8 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BFzsfKvcjYdvGBYmmgAe5oYrIBAAAAAA4AeAEAg&bg=!VFelVxPNAAZvV8FTb1c7ACkAdvg8WlpZl2tgdUcR0HeSFm53W3iYVqG1L-R-slnZIY8HjjBB4kXX3AIAAAFbUgAAACtoAQeZAsxHR8392bdaXlBlcZdEOefqeB1Dh_zV9wj5Kx-7fZ62EeW2FQBT_yztxeICBzYZtx_dttskv5VkkMAlyZZ70-n-wIBgLxgK6QdBwAnPEjeTlZlxEMoWnvpDBZrP_rxQHvidciVUwaF4twS9QPG-jQRBkS2iMkIvMoknGTYLC1YzCW9CZ9-7OSaYchAGkAjjwPCgiWk0zae_g5GHuxTex55ZYkfwExyaMcVMYVs0o7AgzeSl6FzaIU3KSFBHyx8zcNWL7vZagERRQ-n-wVvzK6N1anwtu3XB7VvP1REw8O0f9fwVT_fgtCqI5FKdyI_8oD7jbA5qsWkZcE1-Y7IeQULebn8c0DRXoRjfxC2TlfBYNQHNXTBMht-4B2s_r_A41hoH81e1ZlymbVDaE0AVl-fbgTkQMAf4nDjea4Z2QqC4fDbdHyZ_nd9z4rttrymzdwrtR0Y5Lr6l9OZ_huLnnc2-65Y-zQ4kKRCuaxDfTt-h-5O4G_qg4yhzmvkmjohW2mUQOP6b4alvyo4MEYjbqDRdycnMhOQXmIx7QgH50cxYzIu2PCfMGYs_UVUhYri9VItahbw5MbGYxL_fTWN0mgwvxNei8JNQkNfKLhDsa_okdFuH6N-9IJUt46312rjLa2Dpyscib7zs6kxuXNm505Hecq2NroespZX6N0CfLcHbxoz0vZbc6APkFtjJjsi_14S0Y-JBxDD1jLuU9Yejx3xM2bKwtKvJ-ZAekaGOnXeKHI0hsQr8VkqQosfo7IWCodesN1mIiUO0oJe4VoEildfjBRdJS0-BdpqS3LDpJGAs8p8Hdg7P_TZ8xROoP2nqJjg__FtD-YfX4ybnBCKD7_e_3Hftax8NhFLzK-mmufgJJEYogyEw6z4vUcHcnPm2s6agns_2UsPPqQTJvZLgVzAg3iaVvrosON0gt3kiC_Yu8FWGjtgqs-f0lNyxZQ

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 327E 0
20 B 30ms
30ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bp8aDKvcjYYXcB42lgQeFy7eABwAAAAA4AeAEAg&bg=!MTKlMnbNAAZvV8FTb1c7ACkAdvg8WmpMEij0f43SZhOlXkYctAUt-z0nlWP85ptc0jfSWMM2oglzIQIAAAGIUgAAABZoAQcKALS3SyvbhzbXdYyIGRCQ4yplLwX-W7V6O9JedjaaZHwav_SmarkbFXszHd6OczMYQ74IK-eyhhKAdTzU3xukJ1kzcrCJ6rSOSFyiEfn5cVCPxaYYkI5hAZitQh-i6gOo8ycIwxMmCBJD0LGjBjuF7_fow5hEn7av6vrzih2u7_AF0gqCa4IIMPRPLaa4rb8LmcoyUg5P58mxknO0VJcI-7mo03EoIC9N13IDLd496-cqsDxmgkqZAs5LT4QwBd5ujynkYckuQ-uT-bUUDVTw7uOSB9_dEAisR5uDOAZzma_7YWcmK9gTkF4ZiVVnqM7j4jfOlZ5QwrXc9KuMxusfXL6iCQidR6mmqs_odd3fIL1Q2cRDyqkzjYhhhNK5qugeV3w-Y1DqwIwxaXzQ_kxLxEKxiVqPeXcWuuVU2I6cCLpQoossAoKtu4WM01oqcPGbguIz1jsRap7aPh5NT92zDXNw6gtPgg8AUZKZWWSLoVrT5FPn6X2IZ3CzGb_wUyjClGO6wau68ctoC2IFiIgnJPcSCxfGSEdVzgQ3qrgZiWPOPuZKUY9-PSBbneuwPXlf6f9wiFqmYYNZPda8CcCns09pf2nLKWRm2U7kE2l-COr2Quq4A8vV0lzwOXrHKT1g-OKhH8K2KGE7-wCLdY2VeT3UJs8s2kprSev1E5pRg1Vbj-1XviwEqcYGE-94evhfzhgzqw-oTZ0BM0jjCwokRkS84tmO3af3_foFfYoGDnpje-VB20ePuqvklAg_DEFh_tQ93TIzUA59XhFOKEWYhJ4AA29gFu00td5xnXP3BOK4jf2yoY_pMnFI9f4yMPJcvQIk1zSVtnq_gO1RKkn2iAFTgxgChb8ZO_p-6nUQnu_4ROpmWCog0iNTXsXd1kVL2f8c0LP1eXiHKFLVvL8Su_TRAiEwW2TxZmotOYsF90nC2NUFJoR_L6jAA9W00JUjvUbIaaoI4MbA3a3dBFRhmmqmI7Za21IEoZpIBgRFkpHLQqhn-p3X6c95zEfMOSb7CPPrECcChtszTh024w7ftpGCJlSWGEWNC-NgaEIMrJoLuz6rlNEF3Z09hnJY1W7dM3mYRBK2obTNPBeKDSpufH8Hp8E8i-BeIqWnOXDXwNKkMn0aEImMn1GWo_ArXESWIitcPZu2WOkzomz_DHrfarrUIpTfjlvZQYv_LyQ1wfdxFDuE20FE

Requested by

Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9074 4 KB
757 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=98116500199684200719604011695024&a=0befc47b

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

932060b34fe451f1cb994f3da257f6d2d0f281e1e286e9f3f0e2da63e862fec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 23 Aug 2021 18:59:09 GMT
server: ESF
date: Mon, 23 Aug 2021 19:29:46 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 23 Aug 2021 19:29:46 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9074 44 KB
44 KB 83ms
29ms Image
image/png 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/53619/creativesup/img220807_banners_megekko_affiliate_image_v2-1597759923086-min%20(2).jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=98116500199684200719604011695024&a=0befc47b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 25a637c7097033773feeaaa007a609fe8ad6e145a4fcccd9797452daaf2f1d63

Request headers

Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 23 Aug 2021 19:29:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 44820
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9074 51 KB
51 KB 84ms
30ms Image
image/png 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/58995/creativesup/1200x627.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=98116500199684200719604011695024&a=0befc47b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: ca5b4a17961c9d3fce3d2145bececa7251c2e31294ee47adff213291eaee0cff

Request headers

Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 23 Aug 2021 19:29:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 51809
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9074 48 KB
48 KB 96ms
34ms Image
image/png 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/60306/creativesup/1200x627.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=98116500199684200719604011695024&a=0befc47b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: e39799286c5882dd71c28936de6b5d03174fa7d798cd7cd0bff5fb5e0f6ff770

Request headers

Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 23 Aug 2021 19:29:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 49305
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9074 50 KB
50 KB 107ms
38ms Image
image/png 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/57777/creativesup/1200x627.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=98116500199684200719604011695024&a=0befc47b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 3d4d176076469f657f9062bb4ed6809a1a8be581100513f1ed1bab91f767ddf9

Request headers

Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 23 Aug 2021 19:29:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 51460
Vary: Accept-Encoding
Content-Type: image/png

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 61DD 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BkGBcKvcjYdjeB63X7_UP7vSR2AgAAAAAOAHgBAI&bg=!ExClEFTNAAZvV8FTb1c7ACkAdvg8WlLgGWmIrBrZYtYmvzuC0ekdGKOz1sWG-F0rO_6P2ZGtnVEMgAIAAAFaUgAAAAtoAQcKAKsBEVj67uSGnfJWtyG9gZ0Fb4hx8HsxFOtiq3KdLLzhg44ZiqJ1skqVMInbT4AwcuxXcFuUeBPy3RvYefJtB-5AGE3xw9okhYbBz34SCafJdd3D7GOM2Bmjbhh_x1Int92rcngd-RAfzdRnRyE9RyTZ-b2rMUNmV2BnEZLJvSuXJl1KdNh621hJd2aCaV5WFYbr1Egh7nSq6MBxCfSiE8MDu6JdZ_KdNa4NIBSZAsMzQWPLGlpiP0B3JN7SKXZ0pg6J2Yg6BVQlhPcZvuqVDpOQOOWuTREE2QP6SN7zAw6CckWvxlMZmJWwpvnRb0OjWEscgPuvDcIJZh1HtqwReVQ1pa46zSOCe5AqVuNaEdNceRLuwuQeOPleIJzL9VBzwfZxmUSB-9tN2TzIf1Bgi6pD-IYcjIVZG-doZXWAgB6HFCwb7V4uj_JkjXw5K4TxtUWbr3gMo10PIZD6QvN0JnrckEjgQBQS2IXe0ReaIVJ0Ff5ufWOOUMrPXTPOsVT3MGnDKiPV6TdltlY4zeRkojQc5AX-KQsuVPoU7uz5FWo5BDjKSekPVOMD1832VYomHs25m5-oiAGe_QpgyTizq3JyI2pAY6xmjnCsTJMQJD6BrU-SshbeO6Z12SWoJDha5vMevqvK6eCG3xSMJ9wy1AhQC0zw7KE-d1gZ59aeq0zIfUOI_4Atwj3rDWsV0eB8TKd15ORJ4tECasKYJESaLOsRtB-pv6hVN2AFnEtf4ic8u-YwI-Q33U0IQQH5urVesnrny0VkxTMraYP94Tw--q-84IJsc_ozkMjVi7K2-Ztk6JH21OtmjsAiXX6Z7qcpWdstVtuZ8cxcYEW3Gj2EecnGDpmTjwCl3hPsrGFvu_yIpP1X0rohBcmVg_eirBBJLZXQVlyfJZvhBWiOZ2JXz7ofJx7RS0rj-SiuUnmX8VtNMHfGqQoW7okd800RZH0irq6L6jzeYSkh8WOxLYbHb9DWNlAHyTqJDSG9vEkgYL98LgrFPEeCTiSRN6DVCcLJAbw_WTmReOh9smfdooBjTIUdaZqifhmtTOsvERm34GSe9O4wUbqaY1WarETxI2z5EpqwWpmj70BOn4BVl1JrUIO5vjTJNqRnqHtVUSi64SBTkQnWbmwltlZ8tE9W-Ore4Wjdk1xdjVDaWFxvAwL2xvZUnw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900024.redintelligence.net/ Frame 9074 0
150 B 80ms
27ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/viewability?s=98116500199684200719604011695024&a=530d633d&vb=m
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=98116500199684200719604011695024&a=0befc47b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal900024.redintelligence.net/request_content.php?s=98116500199684200719604011695024&a=0befc47b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 23 Aug 2021 19:29:46 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 9074 16 KB
16 KB 7ms
5ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal900024.redintelligence.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 17:54:23 GMT
x-content-type-options: nosniff
age: 5723
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15948
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:32 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 23 Aug 2022 17:54:23 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 9074 16 KB
16 KB 8ms
6ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal900024.redintelligence.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 13:27:21 GMT
x-content-type-options: nosniff
age: 540145
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 13:27:21 GMT

GET
H2 200 / Show response
htlp.large.nl/ Frame 3DB9 3 KB
3 KB 127ms
59ms Document
text/html 2600:9000:2190:3400:b:a286:7800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://htlp.large.nl/
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=942122184e&subid=&uid=d985a6384a5be65a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZ60KfcjYbCtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_QLD9jwJXQFNQABi0ySzcKbI-BrP7Bn2NycgaJjCBCmKanaawFwYe_dLHnq6PdZZL_dcIeL9NpL7L7SBK37-K1IVDZnsPltQYe4Ueo3YjpKQGVDdZtl_h5lxdE073Q2c4a5tV33UaNme1wqnbHGOS2hEvFLs93h3e-KsvnvIFKAaE9iUBUXVj2W3z-WPzQLTwvm_W34yqnnFPL4x_qSpywsju2oCNWXYQ5Eb_rn3TVs1l0fzVnTVnEAqLyvHQrbFav2wIY-orOZKUy0DLgACHc8ODQls_-GRDABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRolv9vxbfTYsy6_iyBrZJxcHubBA%26sig%3DAOD64_1olfucxqgZ5xozkqle6zk2UCQ1AA%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-DAG1vZkE1zNrOZnWcgRriqMZ0b7UrsrDOb6HveYDdfvZ152dX8I_7QxmALftOi0FVlV8vV6IjLPeqm8BGLR0Y-YAdF8904b2Tg4gvxEWUVYdyhRTVGLy2qHUM5arIxD6ePbRB7VYegFhANLTJPrqHHhEgFFA%26cry%3D1%26dbm_d%3DAKAmf-BNVP-FZJwF1PtlPGDLSQJCcNaOMGCyteptIxFKR0qRJcX1_rs-1_GYB8eevGyy2ng5ERnNfxW33a_vEyy2On1K3_-B0lieSeBcj1c6VoNKzmQidkr_I2RKfoUH9tdW88CFSrEJJyfVvpTA021kdHa0M8BybDhnbw-ZKf3ju00aR8Ib8cMV6VAttKmeyQUIVF3SM9C5HMwNSsP0tn7OFSWGvqbYrrLyj4DJlYHBzsOzn-0YxrkSRvMr4alnOcQFtScDsRzWOH_FTQVILhvSzp6B-eN03pfQBHs8mfVxHo0DCVWCkZv_-f4ZVC7bSSX_OHoJ2JchU29hnByjOYrAe0h8_TS9xdeBY4fbr4a1_1krc77T8LGyuFiCjB-uYLUrFPgnSIZCA3denOT2Sq2mPnRj4tPRApJhpTXTUUFNJfZAg1GjaySnqPn2pTnOWLjislN6jWSX%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=9519821447074&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:3400:b:a286:7800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6bb77d20dd85b4bfae78affeef6ee91869bffa0ef53ed9c8ab9c2a526d0180c5

Request headers

:method: GET
:authority: htlp.large.nl
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

content-type: text/html
content-length: 2647
last-modified: Wed, 08 Jul 2020 09:51:56 GMT
x-amz-version-id: Za5k1aCF3b8ugAP1.Dh5UJVd_ViDWDOf
accept-ranges: bytes
server: AmazonS3
date: Mon, 23 Aug 2021 19:29:47 GMT
cache-control: max-age=10
etag: "81767a046d18dbeec7092a1dbdc70325"
x-cache: RefreshHit from cloudfront
via: 1.1 048a65288aba3f3565a971a2e44151be.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: 4jkhKknexyUfpJpIeXrZ91wMFBo5v9LJzzPDwUZ2uWiYoFzW72TYaw==

GET
H/1.1

200
OK

Cookie set cshow.php Show response
www.zenaps.com/ Frame 5CD3
Redirect Chain

https://www.awin1.com/cshow.php?s=2841812&v=19227&q=409216&r=235229&pref1=33897200160697300719604011695014&pv=1
https://www.zenaps.com/cshow.php?pvr=79c96180-0448-11ec-9723-692d00a25ac2&v=19227&r=235229&q=409216&s=2841812&viewref=33897200160697300719604011695014&pv=1

43 B
707 B

68ms
53ms

Document
image/gif

104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zenaps.com/cshow.php?pvr=79c96180-0448-11ec-9723-692d00a25ac2&v=19227&r=235229&q=409216&s=2841812&viewref=33897200160697300719604011695014&pv=1

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=942122184e&subid=&uid=d985a6384a5be65a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZ60KfcjYbCtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_QLD9jwJXQFNQABi0ySzcKbI-BrP7Bn2NycgaJjCBCmKanaawFwYe_dLHnq6PdZZL_dcIeL9NpL7L7SBK37-K1IVDZnsPltQYe4Ueo3YjpKQGVDdZtl_h5lxdE073Q2c4a5tV33UaNme1wqnbHGOS2hEvFLs93h3e-KsvnvIFKAaE9iUBUXVj2W3z-WPzQLTwvm_W34yqnnFPL4x_qSpywsju2oCNWXYQ5Eb_rn3TVs1l0fzVnTVnEAqLyvHQrbFav2wIY-orOZKUy0DLgACHc8ODQls_-GRDABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRolv9vxbfTYsy6_iyBrZJxcHubBA%26sig%3DAOD64_1olfucxqgZ5xozkqle6zk2UCQ1AA%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-DAG1vZkE1zNrOZnWcgRriqMZ0b7UrsrDOb6HveYDdfvZ152dX8I_7QxmALftOi0FVlV8vV6IjLPeqm8BGLR0Y-YAdF8904b2Tg4gvxEWUVYdyhRTVGLy2qHUM5arIxD6ePbRB7VYegFhANLTJPrqHHhEgFFA%26cry%3D1%26dbm_d%3DAKAmf-BNVP-FZJwF1PtlPGDLSQJCcNaOMGCyteptIxFKR0qRJcX1_rs-1_GYB8eevGyy2ng5ERnNfxW33a_vEyy2On1K3_-B0lieSeBcj1c6VoNKzmQidkr_I2RKfoUH9tdW88CFSrEJJyfVvpTA021kdHa0M8BybDhnbw-ZKf3ju00aR8Ib8cMV6VAttKmeyQUIVF3SM9C5HMwNSsP0tn7OFSWGvqbYrrLyj4DJlYHBzsOzn-0YxrkSRvMr4alnOcQFtScDsRzWOH_FTQVILhvSzp6B-eN03pfQBHs8mfVxHo0DCVWCkZv_-f4ZVC7bSSX_OHoJ2JchU29hnByjOYrAe0h8_TS9xdeBY4fbr4a1_1krc77T8LGyuFiCjB-uYLUrFPgnSIZCA3denOT2Sq2mPnRj4tPRApJhpTXTUUFNJfZAg1GjaySnqPn2pTnOWLjislN6jWSX%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=9519821447074&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Host: www.zenaps.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Content-Type: image/gif
Expires: 0
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Pragma: no-cache
Content-Length: 43
Date: Mon, 23 Aug 2021 19:29:46 GMT
Connection: keep-alive
Set-Cookie: awpv19227=235229|1629746986|79c96180-0448-11ec-9723-692d00a25ac2;domain=.zenaps.com;path=/;expires=Wednesday, 25-Aug-2021 07:29:46 UTC;Secure;SameSite=None AWSESS=409216:2841812;domain=.zenaps.com;path=/;Secure;SameSite=None
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

Redirect headers

Location: https://www.zenaps.com/cshow.php?pvr=79c96180-0448-11ec-9723-692d00a25ac2&v=19227&r=235229&q=409216&s=2841812&viewref=33897200160697300719604011695014&pv=1
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Content-Length: 0
Date: Mon, 23 Aug 2021 19:29:46 GMT
Connection: keep-alive
Set-Cookie: awpv19227=235229|1629746986|79c96180-0448-11ec-9723-692d00a25ac2;domain=.awin1.com;path=/;expires=Wednesday, 25-Aug-2021 07:29:46 UTC;Secure;SameSite=None AWSESS=409216:2841812;domain=.awin1.com;path=/;Secure;SameSite=None
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame E8A3 12 KB
12 KB 207ms
108ms Script
text/html 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2685811&wgcampaignid=1519435&viewref=33897200160697300719604011695014&js=1&nw=1&cp=672691386
Requested by: Host: ufile.io
URL: https://ufile.io/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: e47116cbc234056fd3f07971357fa0f7ea177b84a005df9d11935d95626f589d

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:46 GMT
Last-Modified: Mon, 23 Aug 2021 19:29:46 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900014.redintelligence.net/ Frame 4D7E 8 KB
3 KB 80ms
27ms Document
text/html 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/request_content.php?s=33897200160697300719604011695014&a=29bec7ee
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=u1k7uwfcgkn1&nw=20&renderingType=javascript&namespace=942122184e&subid=&uid=d985a6384a5be65a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZ60KfcjYbCtHeiU7_UP-NeEoA_isNzwX8qDjomlCvAuEAEg08vOMGCRhICA_BfIAQmpAqA0ngStrrM-qAMBqgTZAU_QLD9jwJXQFNQABi0ySzcKbI-BrP7Bn2NycgaJjCBCmKanaawFwYe_dLHnq6PdZZL_dcIeL9NpL7L7SBK37-K1IVDZnsPltQYe4Ueo3YjpKQGVDdZtl_h5lxdE073Q2c4a5tV33UaNme1wqnbHGOS2hEvFLs93h3e-KsvnvIFKAaE9iUBUXVj2W3z-WPzQLTwvm_W34yqnnFPL4x_qSpywsju2oCNWXYQ5Eb_rn3TVs1l0fzVnTVnEAqLyvHQrbFav2wIY-orOZKUy0DLgACHc8ODQls_-GRDABNvzvffUAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRolv9vxbfTYsy6_iyBrZJxcHubBA%26sig%3DAOD64_1olfucxqgZ5xozkqle6zk2UCQ1AA%26client%3Dca-pub-5884294479391638%26dbm_c%3DAKAmf-DAG1vZkE1zNrOZnWcgRriqMZ0b7UrsrDOb6HveYDdfvZ152dX8I_7QxmALftOi0FVlV8vV6IjLPeqm8BGLR0Y-YAdF8904b2Tg4gvxEWUVYdyhRTVGLy2qHUM5arIxD6ePbRB7VYegFhANLTJPrqHHhEgFFA%26cry%3D1%26dbm_d%3DAKAmf-BNVP-FZJwF1PtlPGDLSQJCcNaOMGCyteptIxFKR0qRJcX1_rs-1_GYB8eevGyy2ng5ERnNfxW33a_vEyy2On1K3_-B0lieSeBcj1c6VoNKzmQidkr_I2RKfoUH9tdW88CFSrEJJyfVvpTA021kdHa0M8BybDhnbw-ZKf3ju00aR8Ib8cMV6VAttKmeyQUIVF3SM9C5HMwNSsP0tn7OFSWGvqbYrrLyj4DJlYHBzsOzn-0YxrkSRvMr4alnOcQFtScDsRzWOH_FTQVILhvSzp6B-eN03pfQBHs8mfVxHo0DCVWCkZv_-f4ZVC7bSSX_OHoJ2JchU29hnByjOYrAe0h8_TS9xdeBY4fbr4a1_1krc77T8LGyuFiCjB-uYLUrFPgnSIZCA3denOT2Sq2mPnRj4tPRApJhpTXTUUFNJfZAg1GjaySnqPn2pTnOWLjislN6jWSX%26adurl%3D&documentReferer=https%3A%2F%2Fufile.io%2F&ancestorOrigins=https%3A%2F%2Fufile.io&random=9519821447074&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: fabd74f14b034769f7b3ba7cb9956cd4336cfe8233166e079617963b6921af69

Request headers

Host: hal900014.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=adad0144cf148ad3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/

Response headers

Date: Mon, 23 Aug 2021 19:29:46 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Mon, 23 Aug 2021 20:29:46 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2406
Connection: close
Content-Type: text/html; charset=utf-8

GET
DATA 200
OK truncated
/ Frame E8A3 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5c78949e5543cdbd329aa2577ba004af9d43bb13f622f41fbb0485ff1d405e05

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

e6244d1a4401c7fe26622998bffa5f86940922.png
static.tradetracker.net/nl/material_image/f1/ Frame 78E8
Redirect Chain

https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=98116500199684200719604011695024&t=html
https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png

2 KB
2 KB

83ms
18ms

Image
image/png

2600:9000:2156:da00:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png
Requested by: Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:da00:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a82269bce61196e0aca1c36b304de3471e367a41179284996e6b06b2a3b3009a

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:47 GMT
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
last-modified: Fri, 23 Apr 2021 10:05:11 GMT
server: nginx
x-amz-cf-pop: FRA50-C1
etag: "60829bd7-6cf"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 1743
x-amz-cf-id: GK5Ko13cQl4mar3PqmspGn19HzOME4Ws9bDhNzzCd6VAanL2ifasOQ==

Redirect headers

location: https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png
date: Mon, 23 Aug 2021 19:29:46 GMT
cache-control: no-cache, must-revalidate
server: nginx
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 4D7E 4 KB
648 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=33897200160697300719604011695014&a=29bec7ee

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

932060b34fe451f1cb994f3da257f6d2d0f281e1e286e9f3f0e2da63e862fec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 23 Aug 2021 18:38:24 GMT
server: ESF
date: Mon, 23 Aug 2021 19:29:46 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 23 Aug 2021 19:29:46 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4D7E 59 KB
59 KB 174ms
120ms Image
image/png 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/58593/creativesup/1200x627.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=33897200160697300719604011695014&a=29bec7ee
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 372bae6640d09a9bf6f22433d248dde23a8c3074c22313951e6e20ffe1e758a3

Request headers

Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 23 Aug 2021 19:29:47 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 60174
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4D7E 58 KB
58 KB 164ms
96ms Image
image/png 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/56175/creativesup/1200x627.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=33897200160697300719604011695014&a=29bec7ee
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: b3c456ccb720f3c2d08c43016c16b1646a5205fc1a1bf4ccfee94fdd7d03cc02

Request headers

Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 23 Aug 2021 19:29:47 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 59257
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal900014.redintelligence.net/ Frame 4D7E 0
150 B 91ms
31ms Script
text/html 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/viewability?s=33897200160697300719604011695014&a=ad404e71&vb=m
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=33897200160697300719604011695014&a=29bec7ee
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal900014.redintelligence.net/request_content.php?s=33897200160697300719604011695014&a=29bec7ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 23 Aug 2021 19:29:47 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 4D7E 434 B
700 B 63ms
63ms Script
text/javascript 108.128.25.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=33897200160697300719604011695014&t=js&wid=tt-547730
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=33897200160697300719604011695014&a=29bec7ee
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.128.25.216 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-108-128-25-216.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 24e59670a2705e09eeae422d060ed8cff36085b785e5853160f35db90dd87475

Request headers

Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:47 GMT
cache-control: no-cache, must-revalidate
expires: Mon, 26 Jul 1997 05:00:00 GMT
server: nginx
content-type: text/javascript; charset=UTF-8

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 4D7E 457 B
723 B 62ms
62ms Script
text/javascript 108.128.25.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=&r=33897200160697300719604011695014&t=js&wid=tt-4f7299
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=33897200160697300719604011695014&a=29bec7ee
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.128.25.216 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-108-128-25-216.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 628cb777f923edc4fd4279e7aaeb671e02ee42412642a9c7e83878b56a7bfa72

Request headers

Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:47 GMT
cache-control: no-cache, must-revalidate
expires: Mon, 26 Jul 1997 05:00:00 GMT
server: nginx
content-type: text/javascript; charset=UTF-8

GET
H3-29 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 4D7E 16 KB
16 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal900014.redintelligence.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 21:40:42 GMT
x-content-type-options: nosniff
age: 596944
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15948
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:32 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 21:40:42 GMT

GET
H3-29 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 4D7E 16 KB
16 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal900014.redintelligence.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 21:40:42 GMT
x-content-type-options: nosniff
age: 596944
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 21:40:42 GMT

GET
H2

200

d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
static.tradetracker.net/nl/material_image/6b/ Frame 4D7E
Redirect Chain

https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=33897200160697300719604011695014&t=html
https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif

18 KB
18 KB

22ms
22ms

Image
image/gif

2600:9000:2156:da00:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=33897200160697300719604011695014&a=29bec7ee
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:da00:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0dfdcc9934068e5000d8b906423558878e7cd1b9a6b7b1d566a30a6f969ee71f

Request headers

Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:47 GMT
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
last-modified: Mon, 26 Nov 2018 13:16:08 GMT
server: nginx
x-amz-cf-pop: FRA50-C1
etag: "5bfbf218-4653"
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 18003
x-amz-cf-id: CVEn7A59RFEIi1enbh3jFJOgitPt4s659aTuv4tQRzZ_LTYhhwaGoA==

Redirect headers

location: https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
date: Mon, 23 Aug 2021 19:29:47 GMT
cache-control: no-cache, must-revalidate
server: nginx
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
static.tradetracker.net/nl/material_image/49/ Frame 4D7E
Redirect Chain

https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=33897200160697300719604011695014&t=html
https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg

13 KB
13 KB

11ms
10ms

Image
image/jpeg

2600:9000:2156:da00:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=33897200160697300719604011695014&a=29bec7ee
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:da00:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 6d731e6d3e38558377e2fa974639cabf5209d9cafa5f00e186b0e3faf0aea02b

Request headers

Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:27:28 GMT
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
last-modified: Thu, 16 Mar 2017 08:27:46 GMT
server: nginx
age: 287
etag: "58ca4c82-335a"
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 13146
x-amz-cf-id: cgxXycF6v2vZypJFAazZg57X2TetHH2EKWn_90QvM65TjaFIYevCew==

Redirect headers

location: https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
date: Mon, 23 Aug 2021 19:29:47 GMT
cache-control: no-cache, must-revalidate
server: nginx
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame E8A3 60 KB
61 KB 108ms
34ms Script
application/javascript 13.224.102.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2685811&wgcampaignid=1519435&viewref=33897200160697300719604011695014&js=1&nw=1&cp=672691386
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-88.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 056581eb31e79e98718114a4bd8c104cb64eec86bc5a996a28e61220f3aad189

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: zmpZOOhCPWgwSGI0KhEOhezEiMOIyjV9
via: 1.1 f0f5607a03d2ae4c43b553dc2cef0c9e.cloudfront.net (CloudFront)
last-modified: Wed, 28 Jul 2021 09:15:25 GMT
server: AmazonS3
age: 26996
etag: "a36c650003d82cecddad8f5c37f2cc75"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Mon, 23 Aug 2021 11:59:52 GMT
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 61522
x-amz-cf-id: lcayvInXA_HGU0MqSfNiG8xyJYmdlxtdZLc2W-NmWt1X5wMFlWJdkw==

GET
H/1.1 200
OK hit Show response
diapi.webgains.com/2.0/ Frame E8A3 79 B
374 B 107ms
39ms Script
text/javascript 81.29.72.47
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://diapi.webgains.com/2.0/hit?callback=hitCallback&wgpayload=Nta44iFBBNlY5Du4UXuKrnZ2CI9XkPrwVL6tqAhbrmQmkqlE4Ww.GEFF0Yz3ccbbJYMLgiPFU77qZoOSix5ezdstlYysrhsui6S_Lwka9PnCqxf7_OLgiPFMJhHFW_jftckkCoqAkCoq4ly_0x0uVMV0jftckcKyAd65hz74WySXvOxwawgCgIlNU.3Io3.Nzl998tp7ppfAaZ6m1CdC5MQjGejuTDRNziCvTDfWrOKjB8XagnSjPm8LKfAaZ4ySy.aPjftckt8vOSF_mKqApmvKOPbNpHUkmp1V_15SmSan_EyIxjAKnEIssuTTOUTyShJmVqZtpBSKxUC56MnGWpwoNSUC550ial.rIN90MPJ7DrLJdL1r.S9RdPQSzOy_Aw7UTlf_01kKHoNv_KU.0Y.KI6JtHI_FeAizgzKqUW_xv5icCmVWN9e4WX3NlY5DtThuy.5.m&wgcookie=%7B%22wgifp270885%22%3A%5B%221519435%22%2C%22270885%22%2C%222685811%22%2C%22%22%2C%221629746986%22%2C%22https%253A%252F%252Fa39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com%252F%22%2C%22%22%2C%22%22%2C%221637522986%22%2C%2233897200160697300719604011695014%22%5D%7D&wgchecksum=ce7fb2f969574ff2ab0b48b85b42d704&userIP=213.232.87.179&doAffectv=1&wgtime=1629746986
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2685811&wgcampaignid=1519435&viewref=33897200160697300719604011695014&js=1&nw=1&cp=672691386
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.29.72.47 Epsom, United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 81-29-72-47.servers.dedipower.net
Software: Apache /
Resource Hash: 7e2ad90b0d4e07186244c1742b6cc509ff9f2e651afa446e52fca23ac8c655e0

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 23 Aug 2021 19:29:47 GMT
Server: Apache
Connection: close
Content-Length: 79
Content-Type: text/javascript;charset=utf-8

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame E8A3 3 KB
4 KB 87ms
33ms Image
image/png 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=1519435&viewref=54122100202280000719608011695002&wglinkid=2685811
Requested by: Host: a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
URL: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: a1228bc3c791388213864420c6e03b15f847aa80793dd6d507926a701ec3b9d6

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:47 GMT
Last-Modified: Mon, 23 Aug 2021 19:29:47 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Content-Length: 3191
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 5465 42 B
64 B 29ms
29ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsslCOu58aYDEGDUkNySSZd-sZSvH5P81YNRUapWVcFl--Uk6KmqsJKV5nAX3r_ioBxtPHck07wLjw6qLGVtMzLLktuzbmnXIVcqyajwHDdUjytZP0CgJbER0nvQYg&sai=AMfl-YR-2A_D5u02i0_n4r4RgPoz15C0JufbJWKlyZFsesn1pBg1X3_LW-FhRwbRDqyJny-DgEtHWFqBeeevtsorrmGHNPvZOLigXJIC9zbY5N_OwUiCBPtlMOPAcP7gZqdS&sig=Cg0ArKJSzK-X2EYKumfxEAE&id=ampim&o=315,90&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=151&tls=1151&g=100&h=100&tt=1151&r=v&avms=ampa&adk=1204161151

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview
pagead2.googlesyndication.com/pcs/ Frame E30E 42 B
64 B 29ms
28ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvJUfRsUULrLc8oR_llDuIjg_9uHx_DA3rP-F7a4ajvb9GUD_EK4KYRde12ZVQI8RVODwL6wWhFzeK_RMZIyKPt_PwCm7LE7tGPYy7oIUzJHloN7ykWKp4tb2Exxg&sai=AMfl-YStovE2RCoqNd2ZJbJ1Yu4HSRahxIGaTdeAACldUqFaGzONGi7ESAUUu50t45y4ie2Nxam_nMRWaLHv5FoNb5zLfSXK_cV4_jJ9Zs-SlR36khAMXwGSnZ4C0079WPM9&sig=Cg0ArKJSzDbbKsLP4l3pEAE&id=ampim&o=315,1110&d=970,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=82&tls=1082&g=100&h=100&tt=1082&r=v&avms=ampa&adk=2351176462

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK fp_decode.html Show response
track.webgains.com/ Frame E8A3 63 B
270 B 142ms
45ms Fetch
application/json 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/fp_decode.html?wgpayload=Nta44iFBBNlY5Du4UXuKrnZ2CI9XkPrwVL6tqAhbrmQmkqlE4Ww.GEFF0Yz3ccbbJYMLgiPFU77qZoOSix5ezdstlYysrhsui6S_Lwka9PnCqxf7_OLgiPFMJhHFW_jftckkCoqAkCoq4ly_0x0uVMV0jftckcKyAd65hz74WySXvOxwawgCgIlNU.3Io3.Nzl998tp7ppfAaZ6m1CdC5MQjGejuTDRNziCvTDfWrOKjB8XagnSjPm8LKfAaZ4ySy.aPjftckt8vOSF_mKqApmvKOPbNpHUkmp1V_15SmSan_EyIxjAKnEIssuTTOUTyShJmVqZtpBSKxUC56MnGWpwoNSUC550ial.rIN90MPJ7DrLKHOQ_i.uJtHoqvynx9MsFyxYM914Ve_clrKU.0Y.KI6JtHI_FeAizgzKqUW_xv5icCmVWN9e4WX3NlY5DtThuy.BBJ
Requested by: Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 33b4173f1a772c513fb239f29b34589e245204b6d813d774c8f07ad52ec3861f

Request headers

Accept: application/json
Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 23 Aug 2021 19:29:47 GMT
Server: Apache
Connection: close
Keep-Alive: timeout=1, max=100
Content-Length: 63
Content-Type: application/json

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame E8A3 16 B
232 B 96ms
95ms Fetch
application/json 54.75.239.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.75.239.54 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-75-239-54.eu-west-1.compute.amazonaws.com

Software

nginx / PHP/7.4.21

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.21
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 154ms
33ms Preflight 54.75.239.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Server: 54.75.239.54 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-75-239-54.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame DF6C 52 KB
17 KB 98ms
34ms Document
text/html 2.18.232.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-130.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ufile.io/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ufile.io/

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Tue, 24 Aug 2021 19:29:50 GMT
Date: Mon, 23 Aug 2021 19:29:48 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 7A61 0
0 348ms
110ms Document
text/plain 208.100.17.173
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=aMwmEQ9far64kTaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.100.17.173 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip173.208-100-17.static.steadfastdns.net
Software: 33XP002 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=aMwmEQ9far64kTaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ufile.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ufile.io/

Response headers

x-33x-status: 2000208
server: 33XP002
date: Mon, 23 Aug 2021 19:29:48 GMT

GET
H2 200 connectmyusers.php Show response
cdn.connectad.io/ Frame D358 1 KB
758 B 25ms
21ms Document
text/html 2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.connectad.io/connectmyusers.php?
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60

Request headers

:method: GET
:authority: cdn.connectad.io
:scheme: https
:path: /connectmyusers.php?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ufile.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ufile.io/

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6836c075ae164ed3-FRA
content-encoding: gzip
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2

200

sync Show response
eb2.3lift.com/ Frame 7A70
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
1 KB

23ms
23ms

Document
text/html

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: 6872cdc3d5b165ac121a5b9a5188d8bb3f46f3d8a01b067f27e970cb582083a4

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ufile.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=3314595794925152268
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ufile.io/

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
content-type: text/html; charset=utf-8
content-length: 477
set-cookie: sync=CgoIgQIQ3Yv2o7cvCgoIkQIQ3Yv2o7cvCgoI4gEQ3Yv2o7cvCgoIkgIQ3Yv2o7cvCgoI5gEQ3Yv2o7cvCgoIhwIQ3Yv2o7cvCgkIOhDdi_ajty8KCQgLEN2L9qO3LwoJCF8Q3Yv2o7cvCgkIHxDdi_ajty8=; Max-Age=7776000; Expires=Sun, 21 Nov 2021 19:29:48 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=3314595794925152268; Max-Age=7776000; Expires=Sun, 21 Nov 2021 19:29:48 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

date: Mon, 23 Aug 2021 19:29:48 GMT
content-length: 0
set-cookie: tluid=3314595794925152268; Max-Age=7776000; Expires=Sun, 21 Nov 2021 19:29:48 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 showad.js Show response
ads.pubmatic.com/AdServer/js/ Frame 7D95 38 KB
14 KB 98ms
31ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2497/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 9005ef18fcfb3897cd13c7ec73f90d2b0da0cc7d6153be58cdbe90ad5e2741c8

Request headers

:method: GET
:authority: ads.pubmatic.com
:scheme: https
:path: /AdServer/js/showad.js
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ufile.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ufile.io/

Response headers

last-modified: Tue, 15 Jun 2021 06:07:52 GMT
etag: "13006b6-974e-5c4c7cb53d8cb"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 13946
content-type: text/html; charset=UTF-8
cache-control: public, max-age=71124
expires: Tue, 24 Aug 2021 15:15:12 GMT
date: Mon, 23 Aug 2021 19:29:48 GMT
vary: Accept-Encoding

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D02bf1f51-763e-4bac-9f44-2a36e6af9a71%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID
https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=appnexus&uid=4657211381623794047

0
154 B

97ms
96ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=appnexus&uid=4657211381623794047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:48 GMT
X-Proxy-Origin: 213.232.87.179; 213.232.87.179; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 8e063e99-a23b-40fa-8fa5-6478adc14fb7
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=appnexus&uid=4657211381623794047
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=true
https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=sovrn&uid=df264d5c67019dccc179de3a

0
139 B

96ms
95ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=sovrn&uid=df264d5c67019dccc179de3a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:47 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Date: Mon, 23 Aug 2021 19:29:48 GMT
Server: nginx
Location: https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=sovrn&uid=df264d5c67019dccc179de3a
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

204

verizon_video
prebid.a-mo.net/setuid/
Redirect Chain

https://pixel.advertising.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=02bf1f51-763e-4bac-9f44-2a36e6af9a71
https://pixel.advertising.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=02bf1f51-763e-4bac-9f44-2a36e6af9a71&verify=true
https://ups.analytics.yahoo.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=02bf1f51-763e-4bac-9f44-2a36e6af9a71&apid=UP7aba036c-0448-11ec-9474-0283af615fa2
https://ups.analytics.yahoo.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=02bf1f51-763e-4bac-9f44-2a36e6af9a71&apid=UP7aba036c-0448-11ec-9474-0283af615fa2&verify=true
https://prebid.a-mo.net/setuid/verizon_video?uid=UP7aba036c-0448-11ec-9474-0283af615fa2&gdpr=0&gdpr_consent=

0
125 B

100ms
100ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/verizon_video?uid=UP7aba036c-0448-11ec-9474-0283af615fa2&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Date: Mon, 23 Aug 2021 19:29:48 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://prebid.a-mo.net/setuid/verizon_video?uid=UP7aba036c-0448-11ec-9474-0283af615fa2&gdpr=0&gdpr_consent=
Connection: keep-alive
Content-Length: 0

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID
https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=pubmatic&uid=CE480BBC-F83B-48B4-A728-2E69C75EAB97

0
124 B

96ms
95ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=pubmatic&uid=CE480BBC-F83B-48B4-A728-2E69C75EAB97
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:47 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=pubmatic&uid=CE480BBC-F83B-48B4-A728-2E69C75EAB97
date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dindex_rtb%26uid%3D
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D02bf1f51-763e-4bac-9f44-2a36e6af9a71%26D%3D%26bidder%3Dindex_rtb%26uid%3D&s=191503&C=1
https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=index_rtb&uid=YSP3LN3ZSGwK0g6ct-umHAAA%261127

0
116 B

98ms
96ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=index_rtb&uid=YSP3LN3ZSGwK0g6ct-umHAAA%261127
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ufile.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:47 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://prebid.a-mo.net/setuid?A=02bf1f51-763e-4bac-9f44-2a36e6af9a71&D=&bidder=index_rtb&uid=YSP3LN3ZSGwK0g6ct-umHAAA%261127
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 321
Expires: Mon, 23 Aug 2021 19:29:48 GMT

GET
H2 204 1
sync-eu.connectad.io/syncer/ Frame F839 0
0 32ms
31ms Document
text/plain 2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-eu.connectad.io/syncer/1
Requested by: Host: cdn.connectad.io
URL: https://cdn.connectad.io/connectmyusers.php?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: sync-eu.connectad.io
:scheme: https
:path: /syncer/1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cdn.connectad.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: cadsync
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://cdn.connectad.io/

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
set-cookie: id=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.connectad.io; secure; SameSite=None uid=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.connectad.io; secure; SameSite=None
cache-control: no-cache, private
via: 1.1 google
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6836c075de7e4ed3-FRA

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame DF6C 0
733 B 24ms
24ms Script
text/html 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:48 GMT
X-Proxy-Origin: 213.232.87.179; 213.232.87.179; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 044eee17-4d56-4b08-9dfb-db813388a049
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 7D95 3 KB
4 KB 51ms
16ms Script
text/html 185.64.189.115
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=53484442&p=156762&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.115 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 88e86cfebadccfbe4816d7cee44cd8b2487d36e23682b78c1ce4f55b0aeb17f1

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 7A70 70 B
264 B 39ms
35ms Image
image/gif 13.248.242.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.242.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

xuid
eb2.3lift.com/ Frame 7A70
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm=&google_sc=&gdpr=1&gdpr_consent=&google_tc=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEOLAk2dhLXAIe0of_rj-kwI&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1

37 B
352 B

25ms
25ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEOLAk2dhLXAIe0of_rj-kwI&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEOLAk2dhLXAIe0of_rj-kwI&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 7A70
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMxNDU5NTc5NDkyNTE1MjI2OA%3D%3D
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMxNDU5NTc5NDkyNTE1MjI2OA%3D%3D&google_tc=

170 B
188 B

32ms
32ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMxNDU5NTc5NDkyNTE1MjI2OA%3D%3D&google_tc=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMxNDU5NTc5NDkyNTE1MjI2OA%3D%3D&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 360
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 c.gif
c.bing.com/ Frame 7A70 42 B
422 B 33ms
29ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=3314595794925152268&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:47 GMT
etag: "9d284f105d6fd71:0"
last-modified: Fri, 02 Jul 2021 16:12:32 GMT
x-msedge-ref: Ref A: 01225185D5ED49D6A47AD811C39EE5FA Ref B: FRAEDGE1208 Ref C: 2021-08-23T19:29:48Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame 7A70
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/3314595794925152268?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-nmqFLBNE2oReHSkRKsW9LuyoR2gYhYlPrmD7xHTAaw--~A&dongle=0883

37 B
352 B

25ms
25ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-nmqFLBNE2oReHSkRKsW9LuyoR2gYhYlPrmD7xHTAaw--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Mon, 23 Aug 2021 19:29:48 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-nmqFLBNE2oReHSkRKsW9LuyoR2gYhYlPrmD7xHTAaw--~A&dongle=0883
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 7A70
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=1%26gdpr_consent=
https://eb2.3lift.com/xuid?mid=3335&xuid=4657211381623794047&dongle=4d58&gdpr=1&gdpr_consent=

37 B
352 B

26ms
25ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=4657211381623794047&dongle=4d58&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:48 GMT
X-Proxy-Origin: 213.232.87.179; 213.232.87.179; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5c8f3e86-11e8-41cc-b19f-524ae0739f97
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://eb2.3lift.com/xuid?mid=3335&xuid=4657211381623794047&dongle=4d58&gdpr=1&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 7A70
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=3314595794925152268
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=3314595794925152268&dcc=t

0
0

111ms
110ms

Image
text/html

52.46.133.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=3314595794925152268&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.46.133.124 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:48 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 0XK6FWCAT650CE3A36PQ
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=3314595794925152268&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 7A70
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

37 B
139 B

24ms
23ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:48 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Length: 95
Content-Type: text/html; charset=utf-8

GET
H/1.1 400
Request failed due to privacy signals setuid
ib.adnxs.com/prebid/ Frame 7A70 0
0 33ms
15ms Image
text/html 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/prebid/setuid?bidder=triplelift_native&gdpr=1&gdpr_consent=&uid=3314595794925152268
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H/1.1 400
Request failed due to privacy signals setuid
ib.adnxs.com/prebid/ Frame 7A70 0
0 42ms
17ms Image
text/html 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/prebid/setuid?bidder=triplelift&gdpr=1&gdpr_consent=&uid=3314595794925152268
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 7D3F
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=CE480BBC-F83B-48B4-A728-2E69C75EAB97
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=CE480BBC-F83B-48B4-A728-2E69C75EAB97

35 B
467 B

27ms
27ms

Document
image/gif

37.157.3.29
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=CE480BBC-F83B-48B4-A728-2E69C75EAB97

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.3.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: c1.adform.net
:scheme: https
:path: /serving/cookie/match?CC=1&party=14&cid=CE480BBC-F83B-48B4-A728-2E69C75EAB97
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: C=1; uid=5510720183604041345
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 23 Aug 2021 19:29:48 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
set-cookie: uid=5510720183604041345; expires=Fri, 22 Oct 2021 19:29:48 GMT; domain=adform.net; path=/; secure; samesite=none
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

server: nginx
date: Mon, 23 Aug 2021 19:29:48 GMT
content-length: 0
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=CE480BBC-F83B-48B4-A728-2E69C75EAB97
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
set-cookie: C=1; expires=Thu, 23 Sep 2021 19:29:48 GMT; domain=adform.net; path=/; secure; samesite=none
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 303D
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6726905464725056262

42 B
211 B

23ms
23ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6726905464725056262
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method: GET
:authority: image2.pubmatic.com
:scheme: https
:path: /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6726905464725056262
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: KADUSERCOOKIE=CE480BBC-F83B-48B4-A728-2E69C75EAB97; chkChromeAb67Sec=1; DPSync3=1630886400%3A197_219_201%7C1629763200%3A174; SyncRTB3=1632268800%3A203%7C1630972800%3A35%7C1630281600%3A223%7C1630886400%3A13_161_56_3_21_71_22_7_54_8_220%7C1630540800%3A63; KRTBCOOKIE_57=22776-4657211381623794047; PugT=1629746988; PUBMDCID=3; KRTBCOOKIE_153=19420-f864fy_IuC9kxr15fMeneHCesnpknL8ofZ6MYJQp&KRTB&22979-f864fy_IuC9kxr15fMeneHCesnpknL8ofZ6MYJQp; KRTBCOOKIE_80=22987-CAESEK4iYhggtkInsUtONgt9sV8&KRTB&16514-CAESEK4iYhggtkInsUtONgt9sV8&KRTB&23025-CAESEK4iYhggtkInsUtONgt9sV8; KRTBCOOKIE_27=16735-uid:7d066123-f72c-4600-8d3e-7168c5f16442&KRTB&16736-uid:7d066123-f72c-4600-8d3e-7168c5f16442&KRTB&23019-uid:7d066123-f72c-4600-8d3e-7168c5f16442&KRTB&23114-uid:7d066123-f72c-4600-8d3e-7168c5f16442; KRTBCOOKIE_377=6810-8b81203c-cf97-4db6-893e-6bc1cc5ebd9a&KRTB&22918-8b81203c-cf97-4db6-893e-6bc1cc5ebd9a&KRTB&23031-8b81203c-cf97-4db6-893e-6bc1cc5ebd9a; KRTBCOOKIE_391=22924-5510720183604041345&KRTB&23263-5510720183604041345; KRTBCOOKIE_1101=23040-6999710014239013007; SPugT=1629746988
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 23 Aug 2021 19:29:48 GMT
content-type: image/gif; charset=utf-8
content-length: 42
set-cookie: KRTBCOOKIE_336=5844-6726905464725056262; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 22-Sep-2021 19:29:48 GMT; path=/ PugT=1629746988; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 22-Sep-2021 19:29:48 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 21-Nov-2021 19:29:48 GMT; path=/
x-lat: lhrpug007:0:447
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6726905464725056262
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2 200 usersync.aspx Show response
dis.criteo.com/dis/ Frame 0C7A 43 B
360 B 55ms
16ms Document
image/gif 178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

:method: GET
:authority: dis.criteo.com
:scheme: https
:path: /dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache
pragma: no-cache
content-type: image/gif
expires: Mon, 23 Aug 2021 00:00:00 GMT
server: Microsoft-IIS/10.0
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1169
x-powered-by: ASP.NET
date: Mon, 23 Aug 2021 19:29:48 GMT
content-length: 43

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 32EE
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=9
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6999710014239013007

42 B
210 B

24ms
23ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6999710014239013007
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method: GET
:authority: simage2.pubmatic.com
:scheme: https
:path: /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6999710014239013007
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: KADUSERCOOKIE=CE480BBC-F83B-48B4-A728-2E69C75EAB97; chkChromeAb67Sec=1; DPSync3=1630886400%3A197_219_201%7C1629763200%3A174; SyncRTB3=1632268800%3A203%7C1630972800%3A35%7C1630281600%3A223%7C1630886400%3A13_161_56_3_21_71_22_7_54_8_220%7C1630540800%3A63; KRTBCOOKIE_57=22776-4657211381623794047; PugT=1629746988; PUBMDCID=3; KRTBCOOKIE_153=19420-f864fy_IuC9kxr15fMeneHCesnpknL8ofZ6MYJQp&KRTB&22979-f864fy_IuC9kxr15fMeneHCesnpknL8ofZ6MYJQp; KRTBCOOKIE_80=22987-CAESEK4iYhggtkInsUtONgt9sV8&KRTB&16514-CAESEK4iYhggtkInsUtONgt9sV8&KRTB&23025-CAESEK4iYhggtkInsUtONgt9sV8; KRTBCOOKIE_27=16735-uid:7d066123-f72c-4600-8d3e-7168c5f16442&KRTB&16736-uid:7d066123-f72c-4600-8d3e-7168c5f16442&KRTB&23019-uid:7d066123-f72c-4600-8d3e-7168c5f16442&KRTB&23114-uid:7d066123-f72c-4600-8d3e-7168c5f16442; KRTBCOOKIE_377=6810-8b81203c-cf97-4db6-893e-6bc1cc5ebd9a&KRTB&22918-8b81203c-cf97-4db6-893e-6bc1cc5ebd9a&KRTB&23031-8b81203c-cf97-4db6-893e-6bc1cc5ebd9a; KRTBCOOKIE_391=22924-5510720183604041345&KRTB&23263-5510720183604041345
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 23 Aug 2021 19:29:48 GMT
content-type: image/gif; charset=utf-8
content-length: 42
set-cookie: KRTBCOOKIE_1101=23040-6999710014239013007; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 22-Sep-2021 19:29:48 GMT; path=/ PugT=1629746988; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 22-Sep-2021 19:29:48 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 21-Nov-2021 19:29:48 GMT; path=/
x-lat: lhrpug019:0:432
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Server: nginx
Date: Mon, 23 Aug 2021 19:29:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Set-Cookie: UserID1=6999710014239013007; Max-Age=7776000; domain=.adfarm1.adition.com; Path=/; SameSite=None; Secure
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6999710014239013007

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 7D95
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=zkgLvPg7SLSnKC5px16rlw%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

14 KB
14 KB

38ms
31ms

Image
text/html

2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
content-encoding: gzip
last-modified: Tue, 15 Jun 2021 06:08:03 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3945-5c4c7cc02bd56"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=112308
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5054
expires: Wed, 25 Aug 2021 02:41:36 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 7D95
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=73946123-f72c-4600-9e96-3b5088edb41d

0
260 B

159ms
23ms

Image
text/plain

185.64.190.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=73946123-f72c-4600-9e96-3b5088edb41d
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:47 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Mon, 23 Aug 2021 19:29:45 GMT
Server: MT3 3853 9552a83 master cdg-pixel-x26
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=73946123-f72c-4600-9e96-3b5088edb41d
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 23 Aug 2021 19:29:44 GMT

GET
H/1.1

200
OK

/
pixel.onaudience.com/ Frame 7D95
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=CE480BBC-F83B-48B4-A728-2E69C75EAB97
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=55eb5fd5554a471dc0550df09865dcff

35 B
248 B

98ms
98ms

Image
image/gif

51.79.83.225
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.onaudience.com/?partner=161&icm&cver&mapped=55eb5fd5554a471dc0550df09865dcff
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.79.83.225 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS: pikafka-5.cloudy.ovh
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-length: 35
content-type: image/gif

Redirect headers

date: Mon, 23 Aug 2021 19:29:49 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://pixel.onaudience.com/?partner=161&icm&cver&mapped=55eb5fd5554a471dc0550df09865dcff
cache-control: no-cache
access-control-allow-credentials: true
content-type: text/html
content-length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 7D95
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0U0ODBCQkMtRjgzQi00OEI0LUE3MjgtMkU2OUM3NUVBQjk3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
111 B

25ms
23ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug009:0:379
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 7D95
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK4iYhggtkInsUtONgt9sV8&google_cver=1

42 B
280 B

31ms
24ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK4iYhggtkInsUtONgt9sV8&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug006:0:529
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK4iYhggtkInsUtONgt9sV8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame 7D95 43 B
609 B 60ms
15ms Image
image/gif 159.253.128.188
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.253.128.188 Amsterdam, Netherlands, ASN36351 (SOFTLAYER, US),

Reverse DNS

bc.80.fd9f.ip4.static.sl-reverse.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Sun, 22 Aug 2021 19:29:48 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 7D95
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=5510720183604041345

42 B
234 B

24ms
23ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=5510720183604041345
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug013:0:543
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:48 GMT
server: nginx
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=5510720183604041345
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 7D95
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:7d066123-f72c-4600-8d3e-7168c5f16442&gdpr=0&gdpr_consent=

42 B
341 B

32ms
24ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:7d066123-f72c-4600-8d3e-7168c5f16442&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug013:0:763
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Mon, 23 Aug 2021 19:29:45 GMT
Server: MT3 3853 9552a83 master cdg-pixel-x29
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:7d066123-f72c-4600-8d3e-7168c5f16442&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 23 Aug 2021 19:29:44 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 7D95
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=8b81203c-cf97-4db6-893e-6bc1cc5ebd9a

42 B
293 B

24ms
23ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=8b81203c-cf97-4db6-893e-6bc1cc5ebd9a
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug005:0:504
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:48 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=8b81203c-cf97-4db6-893e-6bc1cc5ebd9a
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 313

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 7D95
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4657211381623794047&gdpr=0&gdpr_consent=

42 B
389 B

23ms
23ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4657211381623794047&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug018:0:394
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:48 GMT
X-Proxy-Origin: 213.232.87.179; 213.232.87.179; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 831b43e7-a6f1-4a5d-a66a-c4e57eced15c
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4657211381623794047&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 CE480BBC-F83B-48B4-A728-2E69C75EAB97
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 7D95 43 B
924 B 47ms
34ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/CE480BBC-F83B-48B4-A728-2E69C75EAB97?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 7D95
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=CE480BBC-F83B-48B4-A728-2E69C75EAB97&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-TEN73PhE2uXmwX9GuSIwTX2DaBvivp0-~A&gdpr=0&gdpr_consent=

0
128 B

150ms
23ms

Image
text/plain

185.64.190.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-TEN73PhE2uXmwX9GuSIwTX2DaBvivp0-~A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Mon, 23 Aug 2021 19:29:48 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-TEN73PhE2uXmwX9GuSIwTX2DaBvivp0-~A&gdpr=0&gdpr_consent=
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 7D95
Redirect Chain

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=f864fy_IuC9kxr15fMeneHCesnpknL8ofZ6MYJQp

42 B
270 B

23ms
23ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=f864fy_IuC9kxr15fMeneHCesnpknL8ofZ6MYJQp
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug001:0:542
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:48 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=f864fy_IuC9kxr15fMeneHCesnpknL8ofZ6MYJQp
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 7D95
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic
https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic
https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=2f2a67c1-8e78-44d6-9613-5bc2cf1610d2&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1f75fa9d-9060-48bc-8a42-031afa400c05&gdpr=&gdpr_consent=&gdpr_pd=

1 B
180 B

24ms
23ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1f75fa9d-9060-48bc-8a42-031afa400c05&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug001:0:747
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=1f75fa9d-9060-48bc-8a42-031afa400c05&gdpr=&gdpr_consent=&gdpr_pd=
date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 7D95
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YSP3LAAD1Agb6wAC&gdpr=0&gdpr_consent=&_test=YSP3LAAD1Agb6wAC

1 B
255 B

23ms
23ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YSP3LAAD1Agb6wAC&gdpr=0&gdpr_consent=&_test=YSP3LAAD1Agb6wAC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 19:29:48 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug010:0:421
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 23 Aug 2021 19:29:48 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1629746989.880526,VS0,VE0
x-served-by: cache-fra19158-FRA
x-cache: HIT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YSP3LAAD1Agb6wAC&gdpr=0&gdpr_consent=&_test=YSP3LAAD1Agb6wAC
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame DF6C 0
733 B 22ms
22ms Script
text/html 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 23 Aug 2021 19:29:49 GMT
X-Proxy-Origin: 213.232.87.179; 213.232.87.179; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 1892c171-f324-4118-a81b-610a0afd4ae9
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

OPTIONS rum
cloudflareinsights.com/cdn-cgi/ Frame 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cloudflareinsights.com
URL: https://cloudflareinsights.com/cdn-cgi/rum

Verdicts & Comments Add Verdict or Comment

113 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.ufile.io/	1970-01-19 20:42:28	Name: __cf_bm Value: 6c0fbbcfd683d91a78f7edd5e8038177bdc155c4-1629746984-1800-AT6Jy9eBNUtRtE82Ne6bxztIXV/IVlnMtnpEO0j0lhdfiMAnVkUXMQ/7wxXGONvp3RKm4n5rlU42vi+hxB9BaQeatnD5gFDwHi6P2FyAx5DjzjchOfaVkSbcmSUdr/Am6KsuGWOZGzAgvsHJoEpeC0s=
.ufile.io/	1970-01-19 20:42:27	Name: _gat Value: 1
.ufile.io/	1970-01-19 20:43:53	Name: ci_sessions Value: 059f9c98oerkudd5u41h5reif7b8f9pf
.ufile.io/	1970-01-19 20:43:53	Name: _gid Value: GA1.2.154237176.1629746985
ufile.io/	1970-01-19 20:52:31	Name: AWSALBCORS Value: q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG
ufile.io/	1970-01-19 20:43:49	Name: __cflb Value: 02DiuHS3BYYUk7Vk5kd2Mb2TAmG4YFevpJCnXVFPFEZiL
.ufile.io/	1970-01-19 20:42:48	Name: csrf_cookie_name Value: 21b8fabe81fb272e6295ec8f01f9798a
.ufile.io/	1970-01-20 14:13:38	Name: _ga Value: GA1.2.1197098049.1629746985
ufile.io/	1970-01-19 20:52:31	Name: AWSALB Value: q3EeAiAh0ezdX+ErLHBw1J7qUVA9cIUKdZAV7gjrnQ7uJf+xyZhRsy1Xu0cTgm4Hh1UGj+BFPf8PBNHfUvC6WYSyY930xd+n5oT/mF/SuvI/HVofCw3GnUKP8UjG

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	info	URL: https://cdn.ampproject.org/rtv/012108100143000/amp4ads-v0.mjs(Line 6) Message: Powered by AMP ⚡ HTML – Version 2108100143000 https://ufile.io/
console-api	info	URL: https://cdn.ampproject.org/rtv/012108100143000/amp4ads-v0.mjs(Line 6) Message: Powered by AMP ⚡ HTML – Version 2108100143000 https://ufile.io/
console-api	log	URL: https://analytics.webgains.io/pvClk.min.js(Line 1) Message: Webgains [object Object]

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a39a841a2918a9b1c95cf07c16744ded.safeframe.googlesyndication.com
acdn.adnxs.com
ads.pubmatic.com
adservice.google.com
adservice.google.nl
analytics.webgains.io
ap.lijit.com
api.webgains.io
b1sync.zemanta.com
c.bing.com
c1.adform.net
cdn.ampproject.org
cdn.connectad.io
cdn.fuseplatform.net
client.crisp.chat
cloudflareinsights.com
cm.g.doubleclick.net
d5p.de17a.com
diapi.webgains.com
dis.criteo.com
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
eb2.3lift.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
hal9000.redintelligence.net
hal900014.redintelligence.net
hal900024.redintelligence.net
hbopenbid.pubmatic.com
htlp.large.nl
i.connectad.io
ib.adnxs.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
loada.exelator.com
match.adsrvr.org
pagead2.googlesyndication.com
pixel.advertising.com
pixel.onaudience.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid.a-mo.net
r.scoota.co
s.amazon-adsystem.com
s0.2mdn.net
securepubads.g.doubleclick.net
simage2.pubmatic.com
ssc-cms.33across.com
ssc.33across.com
ssum.casalemedia.com
static.cloudflareinsights.com
static.tradetracker.net
stats.g.doubleclick.net
sync-eu.connectad.io
sync-tm.everesttech.net
sync.mathtag.com
sync.teads.tv
ti.tradetracker.net
tlx.3lift.com
tpc.googlesyndication.com
track.webgains.com
ufile.io
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
www.awin1.com
www.google-analytics.com
www.google.com
www.googletagservices.com
www.zenaps.com
x.bidswitch.net
cloudflareinsights.com
104.111.239.217
104.111.242.245
108.128.25.216
13.224.102.88
13.248.242.197
138.201.84.252
142.250.181.226
142.250.185.130
147.75.38.124
151.101.14.49
159.253.128.188
172.217.16.130
176.9.26.250
178.250.2.151
18.184.94.176
18.197.99.6
185.29.134.248
185.33.221.89
185.64.189.112
185.64.189.115
185.64.190.80
185.64.190.81
2.18.232.130
2.18.233.180
2.18.234.21
208.100.17.173
213.155.156.167
216.52.2.30
2600:9000:2156:da00:1a:7c92:efc0:93a1
2600:9000:2190:3400:b:a286:7800:93a1
2606:4700:10::6816:37ce
2606:4700:21::681b:c358
2606:4700::6810:5f41
2606:4700::6812:1d5b
2620:116:800d:21:f916:5049:f87f:108e
2620:1ec:c11::200
2a00:1288:110:c305::8000
2a00:1450:4001:800::2001
2a00:1450:4001:801::2002
2a00:1450:4001:802::2003
2a00:1450:4001:803::2006
2a00:1450:4001:80f::2002
2a00:1450:4001:80f::200e
2a00:1450:4001:810::2002
2a00:1450:4001:811::2002
2a00:1450:4001:811::2003
2a00:1450:4001:812::2001
2a00:1450:4001:812::2004
2a00:1450:4001:813::2004
2a00:1450:4001:827::200e
2a00:1450:4001:828::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:831::2001
2a00:1450:4001:831::200a
2a00:1450:400c:c08::9b
2a02:26f0:6c00::210:ba08
3.123.48.64
3.126.56.137
34.254.143.3
35.244.159.8
37.157.3.29
46.236.13.147
46.4.10.49
51.79.83.225
52.17.35.107
52.46.133.124
54.75.239.54
67.202.110.24
70.42.32.95
76.223.111.18
81.29.72.47
85.114.159.93
01870582b641874e601eafe6cd402f3631131ca1863366468e99e015247825e6
03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0
033a754a6c4ba7a1936aaf2900779acd566654b3e0970d692b4562e17a516cd1
0425a19aff98033be59c3fcc1c2f03a4dda5c88696303e8e7503e07caa4c8aa3
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
056581eb31e79e98718114a4bd8c104cb64eec86bc5a996a28e61220f3aad189
08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60
097418ec66aae7247317ef1a2084f927f410a43d292a576b266707de0f52526f
09c1a64d7b662844a62ebd35ed5399a070111877ba3fc15bebe6aa498f135c9a
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c52f7015c565b13167f52309eb741f8e2288ef6653bc3b9cd75893407500a24
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
0dfdcc9934068e5000d8b906423558878e7cd1b9a6b7b1d566a30a6f969ee71f
0e567066985125e7974f68b42914dcb134e3c38373a4a3d668bdb38a3e55f299
0fc795b42e6ad7232caa5faba5cb169a76cffbfe54c147346af1d923fcd3ca9c
1160e4ff88cc798e2b5bcc562c0d49c30144f3965732c59c4b23ef4390ed593f
11b5f6dfaf48d5ae3fbc61a289a621749cd6f68d16ea3b4dc05f8c90021637f5
11cfb56ce29d79384befd6f723e6a96b17bd1d33888642bb7c1fc08d8360fca8
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
131a0a1443ee966b0ff6de6e94ce4e6b1a6b114778bc819b9152a6f1e90d3ebd
1367dfba35126724bf4765c569f3234ebba8732d74e66298e51d81528b3d8df2
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
19aa5d81b4a7a8966c7e03b3ec37dfddd22fc19718d57858fba0c6a9340ec6e6
1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d
1b1bc5d5ada6c2c3cee9893c5f04275250efeecb94cc66832fd53cf831f98c01
1f67a2d6eb0d330f4d74d49ae193e7073cfda5d34fcf3ffdbe7c3c0dea8cc58f
20ad052d59599bc9dc8a415a5084fa67a357c4a3299c6a9d22110341b6878b55
24e59670a2705e09eeae422d060ed8cff36085b785e5853160f35db90dd87475
25a637c7097033773feeaaa007a609fe8ad6e145a4fcccd9797452daaf2f1d63
2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391
2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2ec353765ddc9d5dd78a4d2793230422167859a3ff53a621f4e331bf917f7a39
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
33b4173f1a772c513fb239f29b34589e245204b6d813d774c8f07ad52ec3861f
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
36245251d14ffbce7a49e9017877bae271dba30811a989d6b373aa43832d8c73
372bae6640d09a9bf6f22433d248dde23a8c3074c22313951e6e20ffe1e758a3
38c2584d849164b805bbdf61c420f5ffe53bdbe05adaef33c8de7cc666214ba8
3d4d176076469f657f9062bb4ed6809a1a8be581100513f1ed1bab91f767ddf9
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3e6f35da3ba4ac40ae186c263ade4aa69f8a72a1fcc40937e365b327f7c61265
43619c3dffc4b881e3b2a5b4cee7f1fbb90426c9a58b77a08628683c751a87a0
44b7269e43dd9eb0f9d9ed2a4cf1168952a04760a580770ba9fe63bab404d7f1
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48c154f0e5ffb407462a47a3cc1ee160a70cd56954bf5ae8782eff21a6f4fc30
4aeeb4372ccca59c3a12c0f20db95a990f9bf269886a8e04addf669b1bcf992a
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d803e2074e76f3384fca464f31803c3b894ff65d8649c7100844cf217f50128
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f601e5ffcbdccd40c8485bd0be0ae1cb3c419fc18e7b7eeb5ff085652a0a870
4f8f66f89b9a04c7a86ec677129f7ca1e70f881a8440b49f634699e953da39c9
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
50235ec9793a0ef9fa1e16fc5d47fdfd56f199b343586308c7cbec1e9937435a
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50b0450ce37b28ff538d906f1ca621a949a7f13d8e34a60d0b57b0cac242f7dc
52e62d5f34b1f43219f4423a095094765cdcb4528ec3225faa3103108dd202b6
530fb14ac132185b8671f12b9812823e92de9c56399cb9d1b3f196e2baca8b90
53c4d41f16e87d4bbc6030da4f6a2da8b51ced36d252be39c777261f3a0ac537
59fefd903d714cb8bfc6bcabe7d29723af5b20530998895c1796de004872ef1f
5c02be760adaeca6998e8083cbfb8ce3211c1e85ddf2dbea761af93d466d3e04
5c78949e5543cdbd329aa2577ba004af9d43bb13f622f41fbb0485ff1d405e05
5ccbcf6d22ea0b761807062453a2acd95a34bb9b2603b2650b605df1af2f2960
5d869180dcc114985416a2264e5bb8f7c3b80c17d9b8352319b39242a2d77c2a
5e2c4a8f092ff7e0787ff317c5e1ee91303a2de7525dd135ba54a0729d4a154e
5e976c7ad0b882096e7409c97a8dfa372133d37092f3ed0b1fbde9b7438b4c97
5f6486ad0481a073337fbfa0c22d2fe27e73f99874ca68702eb5c42e78f81677
607fe49372f521f5a6c6c7fcde31ebb07f017c1efea75cbbf167612641e006e7
628cb777f923edc4fd4279e7aaeb671e02ee42412642a9c7e83878b56a7bfa72
638e43a6b51019f159d93c0e1c2d56eba3a8a0591ddd559727278ee653e28fc0
63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90
6872cdc3d5b165ac121a5b9a5188d8bb3f46f3d8a01b067f27e970cb582083a4
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bb77d20dd85b4bfae78affeef6ee91869bffa0ef53ed9c8ab9c2a526d0180c5
6c32f36b9973c4164ba6b9489685b814ee69e1b9c068796b28e8868edd0e20f5
6d731e6d3e38558377e2fa974639cabf5209d9cafa5f00e186b0e3faf0aea02b
72037311a4dfde4d042df73e31b7cbeafc0bdf2aaa605b69aff3326015a396da
7356ab868d5ac2fbd75980c9066c3057d479510e449c518f608f0f15a250e724
794b9baf24cbf03da2db6e00fb01fa42b6545511f3c843863af1dc43d0ca92df
7a2478978968eefdc87127bfe6619a9de514b2ccb89b2a95824a53e6bea1f9cf
7e2ad90b0d4e07186244c1742b6cc509ff9f2e651afa446e52fca23ac8c655e0
7ee8293223afaf5060299bf1d62b7cb1138331fc26e6f91b7108e9f9a3278d51
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
80552188ade64dd7f4ffd7b9dc82b63a67cd59265cde1fb838d7a0d4f0cc56e9
80f5433df727188d43a64cda6f7060bc5117045b2cbcd1492a00183caff5f1ec
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84b1598d2645074dc6424dcb649eeca54a6338c0ce2441e566446b0f1d3f3b49
85bf998720b7201c5b6fbb37000409255a0fbc01b2bc3fd73284a5adcf03fdf8
86004aba5435fd4a14892a5f47e53a870f8e8b815b33737be419bee2bef6080e
86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65
88e86cfebadccfbe4816d7cee44cd8b2487d36e23682b78c1ce4f55b0aeb17f1
8b7878571c8a713102fba10bf4a7b0eedf5980810b0780cbc1850ffc73f27c1c
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8f152dd85f3a9209d7d061d2f80a87d259413629ac793dc1093e40543f915ae7
9005ef18fcfb3897cd13c7ec73f90d2b0da0cc7d6153be58cdbe90ad5e2741c8
9074dbd6a7e81c9ecae5dff24308492f2859887b7e7dcc60d0466d6bf7fd24be
932060b34fe451f1cb994f3da257f6d2d0f281e1e286e9f3f0e2da63e862fec6
9386b81002b3ada59667c03a326520500de5db4f6c8252d5778203613bc19eb9
93e6b4435d1335304d52661e756ee08beb2c92d96ef62310efeb57cc09e9d16c
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
9703693a96f36ad0ead95114c9618d405cbf5697c0e5c1499ed45b4d0115837d
984b348e6ee727db5531514db74def6373130fd06ad69568674c09ad5af8d7ef
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a072b413b6580341066c7e856e8bf74f253d8c47bea5617fb9b91cfa6c6bb79
9c8faba32cf813d34a373a7528d2446d0f2b061f8dd6900391af20ac718f69bd
9d45581f99961212923b84cdf880b7b6d1afcb01350ab8961a1271d7ba795053
9dd189ef52ea74a10651864dd73d21639d99289fb8ca5be69df4aa29c81afc4d
9eae0720c8e0e12bfea3cf3e7322a012311bf0f5cb0d2e2bf857ba103a78356a
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a1228bc3c791388213864420c6e03b15f847aa80793dd6d507926a701ec3b9d6
a360ccdab0ef394c3269af2251321cb022415f776968eb98031f9d623bbb9370
a3f65a89dbf3af6e8998b716ef0579aedf1a720e291b79cce0eeca562c942611
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a82269bce61196e0aca1c36b304de3471e367a41179284996e6b06b2a3b3009a
a8854f3ecb6bc4f68d307982e8f6980d17ed2b310d7c20a868bb52a64ac4bf7e
a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199
abdcd261c1ec6cb1b838a7302139f22740f6eeae1795a968867d4b166e207183
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2438cb43d06bd78bbae85448e2f97affe9055d702aef781ba9e46600dbee3e8
b3c456ccb720f3c2d08c43016c16b1646a5205fc1a1bf4ccfee94fdd7d03cc02
b3f1bbc557dc2ed8f38b03787d581ec132f83b8683f872b3f9c5364706e753a8
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
b8e82c5b550ed0e2f547d9d9f0b53cbe363bef7aa067dec27e7285feb96b2f25
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb51ee26f61a59391e55c6188324ff192ac9494e14716bbf6e40cc7f495f8c18
be8e3fb00d98e93afe954eb362d24a5d80537eb55c896bba9734e5771b6b34b3
c0f3b800e7da50f9ea322b9026d9d673c498e3bbeafe03bedb9889dc2bad102e
c29d0fa59c3e46e73f80349598bf71d74931616380548b99ecce9c62e2649c76
c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f
c69c0dea0450a6dc3447508a0567e7ad976b5dfb5dc58df66f65729ea0451270
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
c9de5f49b6d663d965621b0fdf488395129590473a81ba80be2e4c841c2607cf
ca5b4a17961c9d3fce3d2145bececa7251c2e31294ee47adff213291eaee0cff
cb7b7d190694be38113cca0c23988163a6842884615e6747d8454705df595a10
cce2d9e56822ca13d0bc323ca0d7a4a6205b58a7006eea4ca3256f77da7a6a0c
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d044c71ec435f83929bffbc134b7f5d95a3b9654cef39a5fb59ee606707ff77f
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d416d7edf7d9d6f041761f68d1057b9c1607be38b6d682e87266f54f2492baa4
d6e0cf33bd31faca2542d9376cc2a8b9722904e24cc4d3bfc121048e46c244ea
d6e58e15d1ba473482af846586fa3edea99b157d9473b7e036675098c019150d
daf1a58c0da7232cc995f0e1c211cb4d9212df84a65b1b57b5f15879b6349677
df1d622945677aae49846a481ecb65660fad66aecc8d278011484ed477e30952
e39799286c5882dd71c28936de6b5d03174fa7d798cd7cd0bff5fb5e0f6ff770
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e47116cbc234056fd3f07971357fa0f7ea177b84a005df9d11935d95626f589d
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
e965d20da290ec24b2da39b0e94a617c69afc466297e9990b56ce8a42fe85e15
ea03f86b5795d0be9e7cd0202cf1d812a235e2f3a65c94eb8aeeba969c4fe309
ee49247c1e3cae5249689b033a944e7970fe9930796f93c0bb3b3a6c86db34fa
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309
f2ffb31507b69e5bce642956ea53a12d5764ec30efa659fb4d983d3266bd48d8
f3670767b1eb59f50471a503f7cd7bc6657147e9e57663ece58a94756bf36ed5
f7f768f129c2c71cdd195bc42f800c081e5d9804df4df180f851497957822151
f89a25dd9b6dd0097ef4c92e0f1a4cd5e333ef435a68368b3934b82466cc3507
fa37fadc4b97fd670f3347bb11240c68153add0170aee54fd555c682aed7533a
fabd74f14b034769f7b3ba7cb9956cd4336cfe8233166e079617963b6921af69
fb9d20b37b11d2231f752dd1a8edb1394b3345fd682beae62c19cb6c1de22765
fe2fe85118c84a34bed1d4e7836cdeaef1535ba6aed70c7361f0cb756cc16222

ufile.io Open in urlscan Pro 2606:4700:21::681b:c358 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

260 Requests

100 %HTTPS

40 %IPv6

49 Domains

74 Subdomains

62 IPs

10 Countries

3251 kBTransfer

6395 kBSize

9 Cookies

17 Outgoing links

Page URL History

Redirected requests

260 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

ufile.io Open in urlscan Pro
2606:4700:21::681b:c358 Public Scan

Screenshot
Live screenshot

Full Image

260
Requests

100 %
HTTPS

40 %
IPv6

49
Domains

74
Subdomains

62
IPs

10
Countries

3251 kB
Transfer

6395 kB
Size

9
Cookies

260 HTTP transactions
6 data transactions