www.manicapost.co.zw Open in urlscan Pro
2606:4700:20::681a:534 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://manicapost.co.zw/
Effective URL:
https://www.manicapost.co.zw/
Submission: On May 31 via automatic, source certstream-suspicious (May 31st 2021, 5:46:06 am UTC)

Summary HTTP 378 Redirects Links 43 Behaviour Indicators

Summary

This website contacted 43 IPs in 5 countries across 24 domains to perform 378 HTTP transactions. The main IP is 2606:4700:20::681a:534, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.manicapost.co.zw.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 31st 2021. Valid for: a year.

This is the only time www.manicapost.co.zw was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 52	2606:4700:20:... 2606:4700:20::681a:534	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:20:... 2606:4700:20::ac43:481a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:a823	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	151.101.112.134 151.101.112.134	54113 (FASTLY) (FASTLY)
7	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
13	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
27	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
24	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
28	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
113	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2006	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
2	142.250.180.195 142.250.180.195	15169 (GOOGLE) (GOOGLE)
8 15	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
6 10	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
2 4	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	185.33.220.243 185.33.220.243	29990 (ASN-APPNEX) (ASN-APPNEX)
2 3	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1 2	104.111.242.245 104.111.242.245	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
1	2a00:1288:80:... 2a00:1288:80:800::7000	203220 (YAHOO-DEB) (YAHOO-DEB)
2	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
6	138.201.64.38 138.201.64.38	24940 (HETZNER-AS) (HETZNER-AS)
1 4	159.69.70.9 159.69.70.9	24940 (HETZNER-AS) (HETZNER-AS)
1 4	138.201.220.30 138.201.220.30	24940 (HETZNER-AS) (HETZNER-AS)
1 4	138.201.63.164 138.201.63.164	24940 (HETZNER-AS) (HETZNER-AS)
9 18	34.246.49.61 34.246.49.61	16509 (AMAZON-02) (AMAZON-02)
9	2600:9000:218... 2600:9000:2182:800:1a:7c92:efc0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:803::2012	15169 (GOOGLE) (GOOGLE)
1	142.250.185.210 142.250.185.210	15169 (GOOGLE) (GOOGLE)
378	43

52 2606:4700:20::681a:534 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

manicapost.co.zw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.manicapost.co.zw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:481a (United States)

ASN13335 (CLOUDFLARENET, US)

manicapost.zimpapersnetwork.co.zw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a823 (United States)

ASN13335 (CLOUDFLARENET, US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.112.134 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

the-manica-post.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 216.58.212.162 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

113 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.180.195 (United States)

ASN15169 (GOOGLE, US)
PTR: bud02s33-in-f3.1e100.net

p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany) 8 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 172.217.18.98 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.18.234.21 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.220.243 (Amsterdam, Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.98.64.218 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.242.245 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.94.180.125 (United States) 2 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:80:800::7000 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 138.201.64.38 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.38.64.201.138.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 159.69.70.9 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.9.70.69.159.clients.your-server.de

hal900017.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.220.30 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.30.220.201.138.clients.your-server.de

hal900016.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.63.164 (Lingenfeld, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.164.63.201.138.clients.your-server.de

hal90006.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 34.246.49.61 (Dublin, Ireland) 9 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-246-49-61.eu-west-1.compute.amazonaws.com

ti.tradetracker.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2600:9000:2182:800:1a:7c92:efc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.tradetracker.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2012 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i1-v6exp3.ds.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.210 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f18.1e100.net

p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i2-v6exp3.v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
152	googlesyndication.com pagead2.googlesyndication.com d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com tpc.googlesyndication.com	1 MB
52	doubleclick.net 6 redirects securepubads.g.doubleclick.net googleads.g.doubleclick.net static.doubleclick.net cm.g.doubleclick.net	364 KB
52	manicapost.co.zw 1 redirects manicapost.co.zw www.manicapost.co.zw	834 KB
27	tradetracker.net 9 redirects ti.tradetracker.net static.tradetracker.net	112 KB
21	ampproject.org cdn.ampproject.org	415 KB
21	google.com 8 redirects adservice.google.com www.google.com	2 KB
18	redintelligence.net 3 redirects hal9000.redintelligence.net hal900017.redintelligence.net hal900016.redintelligence.net hal90006.redintelligence.net	67 KB
13	googletagservices.com www.googletagservices.com	445 KB
10	gstatic.com fonts.gstatic.com www.gstatic.com p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i1-v6exp3.ds.metric.gstatic.com p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i2-v6exp3.v4.metric.gstatic.com	94 KB
8	youtube.com www.youtube.com	625 KB
5	googleapis.com fonts.googleapis.com	3 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com	4 KB
4	disqus.com the-manica-post.disqus.com	6 KB
3	spotxchange.com 2 redirects sync.search.spotxchange.com	2 KB
3	openx.net 2 redirects us-u.openx.net	831 B
3	adnxs.com 2 redirects ib.adnxs.com	3 KB
3	google.de adservice.google.de	452 B
2	teads.tv 1 redirects sync.teads.tv	414 B
2	googleadservices.com partner.googleadservices.com	511 B
2	google-analytics.com www.google-analytics.com	19 KB
1	yahoo.com ads.yahoo.com	445 B
1	googletagmanager.com www.googletagmanager.com	32 KB
1	cloudflare.com ajax.cloudflare.com	5 KB
1	zimpapersnetwork.co.zw manicapost.zimpapersnetwork.co.zw	5 KB
378	24

	Domain	Requested by
116	tpc.googlesyndication.com	securepubads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net www.manicapost.co.zw d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com cdn.ampproject.org
51	www.manicapost.co.zw	www.manicapost.co.zw ajax.cloudflare.com
30	googleads.g.doubleclick.net	pagead2.googlesyndication.com www.youtube.com googleads.g.doubleclick.net d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com www.manicapost.co.zw
29	pagead2.googlesyndication.com	ajax.cloudflare.com pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net securepubads.g.doubleclick.net d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com www.googletagservices.com
21	cdn.ampproject.org	securepubads.g.doubleclick.net
18	ti.tradetracker.net	9 redirects www.manicapost.co.zw hal900016.redintelligence.net hal90006.redintelligence.net hal900017.redintelligence.net
18	www.google.com	8 redirects tpc.googlesyndication.com www.manicapost.co.zw d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
13	www.googletagservices.com	ajax.cloudflare.com pagead2.googlesyndication.com googleads.g.doubleclick.net securepubads.g.doubleclick.net d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
11	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.manicapost.co.zw
10	cm.g.doubleclick.net	6 redirects googleads.g.doubleclick.net
9	static.tradetracker.net	d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com hal900016.redintelligence.net hal90006.redintelligence.net hal900017.redintelligence.net
8	www.youtube.com	www.manicapost.co.zw www.youtube.com
7	d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
6	hal9000.redintelligence.net	d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com hal900016.redintelligence.net hal90006.redintelligence.net hal900017.redintelligence.net
5	fonts.googleapis.com	securepubads.g.doubleclick.net tpc.googlesyndication.com hal900016.redintelligence.net hal90006.redintelligence.net hal900017.redintelligence.net
5	fonts.gstatic.com	www.youtube.com fonts.googleapis.com
4	hal90006.redintelligence.net	1 redirects d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com hal90006.redintelligence.net
4	hal900016.redintelligence.net	1 redirects d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com hal900016.redintelligence.net
4	hal900017.redintelligence.net	1 redirects d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com hal900017.redintelligence.net
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	the-manica-post.disqus.com	ajax.cloudflare.com the-manica-post.disqus.com
3	sync.search.spotxchange.com	2 redirects googleads.g.doubleclick.net
3	us-u.openx.net	2 redirects googleads.g.doubleclick.net
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	adservice.google.com	pagead2.googlesyndication.com securepubads.g.doubleclick.net
3	adservice.google.de	pagead2.googlesyndication.com securepubads.g.doubleclick.net
2	sync.teads.tv	1 redirects googleads.g.doubleclick.net
2	p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com	googleads.g.doubleclick.net p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com
2	partner.googleadservices.com	pagead2.googlesyndication.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i2-v6exp3.v4.metric.gstatic.com
1	p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i1-v6exp3.ds.metric.gstatic.com
1	ads.yahoo.com	googleads.g.doubleclick.net
1	www.gstatic.com	www.youtube.com
1	static.doubleclick.net	www.youtube.com
1	www.googletagmanager.com	www.manicapost.co.zw
1	ajax.cloudflare.com	www.manicapost.co.zw
1	manicapost.zimpapersnetwork.co.zw	www.manicapost.co.zw
1	manicapost.co.zw	1 redirects
378	39

This site contains links to these domains. Also see Links.

Domain
www.sundaymail.co.zw
ebusinessweekly.co.zw
www.chronicle.co.zw
www.sundaynews.co.zw
www.b-metro.co.zw
hmetro.co.zw
www.kwayedza.co.zw
southernafrican.news
www.ztn.co.zw
printhub.co.zw
www.facebook.com
twitter.com
www.classifieds.co.zw
www.property.co.zw
www.webdev.co.zw
www.paynow.co.zw
www.topup.co.zw
www.herald.co.zw
www.youtube.com

Subject Issuer	Validity	Valid
manicapost.co.zw Cloudflare Inc ECC CA-3	`2021-05-31` - `2022-05-30`	a year	crt.sh
zimpapersnetwork.co.zw Cloudflare Inc ECC CA-3	`2021-05-30` - `2022-05-29`	a year	crt.sh
ajax.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-11` - `2022-08-16`	2 years	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2020-04-20` - `2022-05-09`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-05-03` - `2021-07-26`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-05-03` - `2021-07-26`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-05-03` - `2021-07-26`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
teads.tv R3	`2021-05-04` - `2021-08-02`	3 months	crt.sh
*.search.spotxchange.com GeoTrust RSA CA 2018	`2021-04-08` - `2022-05-09`	a year	crt.sh
*.ads.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-05-11` - `2021-06-30`	2 months	crt.sh
redintelligence.net R3	`2021-04-21` - `2021-07-20`	3 months	crt.sh
*.tradetracker.net Amazon	`2020-12-20` - `2022-01-18`	a year	crt.sh
*.ds.metric.gstatic.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.v4.metric.gstatic.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh

This page contains 45 frames:

Primary Page: https://www.manicapost.co.zw/
Frame ID: F6B7FD14F4119130DDFACE6E62E0E16B
Requests: 77 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210524/r20190131/zrt_lookup.html
Frame ID: ACBF63F24143C1AE957624CD2612C0F1
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/
Frame ID: C24B9CBE580CFA26923062FC7C643F3E
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3988215234&adk=2335021192&adf=2830833273&pi=t.ma~as.3988215234&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948798&bpp=3&bdt=2247&idt=74&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&correlator=1441014396034&frm=20&pv=2&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=2608&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=XimnFqFLYM&p=https%3A//www.manicapost.co.zw&dtd=124
Frame ID: C9A331A2C462500959733003E3E9C341
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134
Frame ID: 9DD9173FE63D76BA6F728E635C1E2324
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=9292512808&adk=53181682&adf=1550776291&pi=t.ma~as.9292512808&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948802&bpp=1&bdt=2251&idt=138&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148%2C680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=4580&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=5wI7VeVUOy&p=https%3A//www.manicapost.co.zw&dtd=140
Frame ID: 6B0BC1DFF6489FCC6FABBADA801E0E81
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&adk=1309968118&adf=3288313458&lmt=1622439948&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948826&bpp=1&bdt=2275&idt=164&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db5952aeb8a19fa04-2296b2ee58c800fe%3AT%3D1622439948%3ART%3D1622439948%3AS%3DALNI_MYctW0KfM2oGCk-eStVn648JdKTGg&prev_fmts=680x148%2C680x148%2C680x148&nras=1&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=6&uci=a!6&fsb=1&dtd=174
Frame ID: 35DFB4F11CB3CCFABF223AC751966DB2
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: E0AF78C86E61BE4D8AD00CC41A98BB10
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: E44D7201360767F1DD3B1B4B7A5BAEE9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 4E30014DECBE37A56793EA0E5C2B91E5
Requests: 2 HTTP requests in this frame

Frame: https://p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Frame ID: 13D96D2DD2E6BAB5DDFDFF149BA1F545
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 77EBDE6AD440C4B3054EDF2FB419E923
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 6F5818F626E4AB4960AD5BE6E3503DBD
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js
Frame ID: CA63E1C6D67EE63E455FAE9649D66D46
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js
Frame ID: 5B76891D0C3962A0EE0C5389E79DF8B9
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js
Frame ID: C67005D736050326D2BAE4ECB0D15B54
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu5DTBHyycQsTjGnm308ggOKhiSRcYkeN2sHIlr-3LzITPNaAMsg71YNq8eHdr-TKFbexeir0pLb6BBzr5wW3eOgoyiEIAmtuTrcaxCKGiPMeho18_sVL8xRJ2MHV_15WebaH_IC9StjYzyInCTTfuLgEeBnOtURcU3lxeeimjWTSURamgemJHpy11KMDR3z_nbk26NyxC4OlfWxxswHLEE1FhdL9E1f5jvKH3tK0G5-k3GeZUTAxkYoBXGBT5C6XNjSmx-xp3xPJW3JacjXjMhbg9zUiIdrpRG9x665kx7e1k9LKUmA8X05hU&sai=AMfl-YQylEgUwNYQJCoYa6UbfpFEMA8nfLuYhHLHqFpUCBFMsbsxYKUWdLChU9LTk2RgVIlqZkSIGLN7jLeYniA2wwmFYXDHnUz9vP-Q2XN3OPW_KQahlROL0FXBNiqC7THI&sig=Cg0ArKJSzLIbPKvJ_TxJEAE&urlfix=1&adurl=
Frame ID: A74B95E6FDEADCD18DE16F27DDE49AEF
Requests: 14 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs
Frame ID: DD9077C49D2A89B713E9379C6B829D7B
Requests: 17 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs
Frame ID: 6F98DBC57CDEC9D6CFEC7C2764A374F6
Requests: 16 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs
Frame ID: 1F4C1E58A61F83B214D0F7F39075636C
Requests: 15 HTTP requests in this frame

Frame: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 9049A7739B7C8868C8BDA0CE34C50478
Requests: 8 HTTP requests in this frame

Frame: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: B4E01AE3F9A5B5869A4BF6D363E90CD1
Requests: 8 HTTP requests in this frame

Frame: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 23623998DDBE6AF5C67737D96D8D43C7
Requests: 8 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs
Frame ID: 82116D4546747034A5486F814379EEE9
Requests: 17 HTTP requests in this frame

Frame: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 987741B62197F643AD0ABD6FEC094F55
Requests: 13 HTTP requests in this frame

Frame: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 670F26213CEB2CFC00B7832AA7751605
Requests: 13 HTTP requests in this frame

Frame: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 9B19A7E6EE57ED53974EBA49D973121C
Requests: 13 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html
Frame ID: E1D5689768140A518A84B9A22D97EF39
Requests: 21 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/index.html
Frame ID: 35870F388DF9A546A2A82EA085F06B6D
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html
Frame ID: 7EF035982A39C484E0D9E97A428F4B4B
Requests: 21 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1Ku1PTAB&v=APEucNUc30iRQzrNWo0k3BjYziEphw6obZbTEhp0lf9l_NtVCvz_XPqCBQERtkB57x_Knik78cbrTZZBUCIwWRWbRYSN9sd-kMgemJmqH2cU1DfLoxT1SSR-5r17nv4GqYFSwcmeusYQWW0JvLHIl3UPiUCGjfBetvZZDm1TKe0vka3JDRKOO6I
Frame ID: 65B08B6413A78AA9EB2A2A5DAFDABBA0
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYntXZlQEwAQ&v=APEucNWURRadUb_DLPYWG9yskoRc1xbjFre5gIVvBBgtJjTcgwOYygF-M1VV-IkRH-6xuhV7N9trUovceEECtKn-cdX4Hyqk5NbmAOFN-lGMsIar0iDy82_UksL8w_EcVLq00tKV6g_DXh6nc0SwB4cV9ZsmfCOfS9XjvS4dqedgdXsaBIdukp0
Frame ID: 91D85EC4C3E50B543046461D0B3ABCD3
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1Ku1PTAB&v=APEucNWj-v1LkEd3xbqzOwFyIXp8GJ6fWnxhsE-TIaq8I2RuZA5cV4Wz5_fQUBpOooCIVA_6291marC_EN3kCnmgmy967G-H_pIcnjHIrE-8O916hFo8kws40pQgJe8WXdMInAWFTCGsWmFiEa4dOiZ5OStqPeFaU3UEmbbV0SPW6Z_LBHKv5UM
Frame ID: 05403CEA512A387DEF6D043F45284B42
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2059963059415547&output=html&h=100&slotname=Zimpaper_320x100&adk=2950050393&adf=816031645&pi=t.ma~as.Zimpaper_320x100&w=320&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439950332&bpp=7&bdt=222&idt=194&shv=r20210524&cbv=%2Fr20190131&ptt=5&saldr=sa&cookie=ID%3Db5952aeb8a19fa04-2296b2ee58c800fe%3AT%3D1622439948%3AS%3DALNI_MYctW0KfM2oGCk-eStVn648JdKTGg&correlator=1441014396034&frm=23&ife=4&pv=2&ga_vid=866574880.1622439951&ga_sid=1622439951&ga_hid=592487814&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=986&ady=307&biw=1600&bih=1200&isw=320&ish=100&ifk=3847667090&scr_x=0&scr_y=0&eid=42530672&oid=3&pvsid=606131567089719&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C320%2C100&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.qedgoscj8vih&fsb=1&dtd=210
Frame ID: 82F2FBAB78B7C690F0A00050F8914105
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: F6EBAAF67C9892236386168530FF69A6
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: D8F593193597C95E3D660A36A2171A91
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 9937571964D2F0064665D2B359DBA9A9
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 3E981C3C29850A68C01F548725059E46
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 402799041639418FAE5EB0D6F0B27B70
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 3EBB7B7AE861B965C7895ED0A1B39D1F
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: 8AF39C84C8E26B5CFF7E2911003A5C43
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: F44D1F48A03E9EE8D0B3AD4CF940ECDC
Requests: 1 HTTP requests in this frame

Frame: https://hal900016.redintelligence.net/request_content.php?s=16167500031559200719608011611016&a=80a24ce5
Frame ID: ED887E5459B58CFC5A8D412295BD8BC2
Requests: 8 HTTP requests in this frame

Frame: https://hal90006.redintelligence.net/request_content.php?s=25646200030154900719608011611006&a=510c5bc8
Frame ID: 3ADD9ABADD0DB33C2B57C3CE5E95B087
Requests: 8 HTTP requests in this frame

Frame: https://hal900017.redintelligence.net/request_content.php?s=93147700025802000719608011611017&a=2b20bbd4
Frame ID: 4C5D57FBD696B4641383D1B81A9691AB
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://manicapost.co.zw/ HTTP 301
https://www.manicapost.co.zw/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

378
Requests

99 %
HTTPS

64 %
IPv6

24
Domains

39
Subdomains

43
IPs

5
Countries

4326 kB
Transfer

10653 kB
Size

0
Cookies

43 Outgoing links

These are links going to different origins than the main page.

URL: https://www.sundaymail.co.zw/
Title: The Sunday Mail

Search URL Search Domain Scan URL

URL: http://ebusinessweekly.co.zw/
Title: Business Weekly

Search URL Search Domain Scan URL

URL: https://www.chronicle.co.zw/
Title: Chronicle

Search URL Search Domain Scan URL

URL: http://www.sundaynews.co.zw/
Title: Sunday News

Search URL Search Domain Scan URL

URL: http://www.b-metro.co.zw/
Title: B-Metro

Search URL Search Domain Scan URL

URL: http://hmetro.co.zw/
Title: H-Metro

Search URL Search Domain Scan URL

URL: http://www.kwayedza.co.zw/
Title: Kwayedza

Search URL Search Domain Scan URL

URL: https://southernafrican.news/
Title: The Southern Times

Search URL Search Domain Scan URL

URL: http://www.ztn.co.zw/
Title: ZTN

Search URL Search Domain Scan URL

URL: http://printhub.co.zw/advertise
Title: Advertise

Search URL Search Domain Scan URL

URL: http://printhub.co.zw/subscribe
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://www.facebook.com/TheManicaPost

Search URL Search Domain Scan URL

URL: https://twitter.com/ManicaPostZim

Search URL Search Domain Scan URL

URL: https://www.classifieds.co.zw/
Title: Classifieds

Search URL Search Domain Scan URL

URL: https://www.classifieds.co.zw/en/zimbabwe-electronics-160
Title: Electronics

Search URL Search Domain Scan URL

URL: https://www.classifieds.co.zw/en/zimbabwe-cars-vehicles-15
Title: Cars & Parts

Search URL Search Domain Scan URL

URL: https://www.classifieds.co.zw/en/zimbabwe-building-supplies-24763
Title: Building Supplies

Search URL Search Domain Scan URL

URL: https://www.classifieds.co.zw/en/zimbabwe-services-24369
Title: Services

Search URL Search Domain Scan URL

URL: https://www.property.co.zw/
Title: Property, Houses

Search URL Search Domain Scan URL

URL: https://www.classifieds.co.zw/en/zimbabwe-home-garden-kids-17
Title: Home & Garden

Search URL Search Domain Scan URL

URL: https://www.classifieds.co.zw/en/zimbabwe-leisure-sports-travel-24774
Title: Leisure & Travel

Search URL Search Domain Scan URL

URL: https://www.classifieds.co.zw/en/zimbabwe-commercial-supplies-24778
Title: Commercial Supplies

Search URL Search Domain Scan URL

URL: https://www.classifieds.co.zw/en/zimbabwe-health-fashion-beauty-24733
Title: Fashion & Beauty

Search URL Search Domain Scan URL

URL: https://www.classifieds.co.zw/en/zimbabwe-jobs-14
Title: Jobs

Search URL Search Domain Scan URL

URL: https://www.webdev.co.zw/web-design-development/
Title: Web Development

Search URL Search Domain Scan URL

URL: https://www.webdev.co.zw/domain-registration/
Title: Domain Registration

Search URL Search Domain Scan URL

URL: https://www.webdev.co.zw/email-hosting/
Title: Email Hosting

Search URL Search Domain Scan URL

URL: https://www.webdev.co.zw/hosting/
Title: Web Hosting

Search URL Search Domain Scan URL

URL: https://www.paynow.co.zw/
Title: Online Payments

Search URL Search Domain Scan URL

URL: https://www.topup.co.zw/pay/zesa-prepaid-electricity-token
Title: Buy ZESA Tokens

Search URL Search Domain Scan URL

URL: https://www.topup.co.zw/buy-telone-adsl-vouchers-online
Title: Buy TelOne ADSL

Search URL Search Domain Scan URL

URL: https://www.topup.co.zw/airtime
Title: Buy Airtime

Search URL Search Domain Scan URL

URL: https://www.topup.co.zw/tuition-fees
Title: Pay Tuition Fees

Search URL Search Domain Scan URL

URL: https://www.topup.co.zw/buy-netone-onefusion-vouchers-online
Title: Pay Nyaradzo

Search URL Search Domain Scan URL

URL: https://www.topup.co.zw/donations
Title: Make Donations

Search URL Search Domain Scan URL

URL: https://www.topup.co.zw/
Title: Airtime & Bills

Search URL Search Domain Scan URL

URL: https://www.topup.co.zw/pay/city-of-harare
Title: City of Harare

Search URL Search Domain Scan URL

URL: https://www.herald.co.zw/wp-content/uploads/sites/2/2021/04/HOMESTYLE-NEWSLETTER-155943.pdf

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/Zimpapers

Search URL Search Domain Scan URL

URL: https://www.herald.co.zw/
Title: The Herald

Search URL Search Domain Scan URL

URL: http://www.sundaymail.co.zw/
Title: The Sunday Mail

Search URL Search Domain Scan URL

URL: https://www.herald.co.zw/about-zimpapers/
Title: About Zimpapers

Search URL Search Domain Scan URL

URL: http://www.webdev.co.zw/
Title: Site & Hosting by Webdev

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://manicapost.co.zw/ HTTP 301
https://www.manicapost.co.zw/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 112

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 123

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 125

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 197

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 198

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 272

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHgvLN1DAj7GohL4jtORceQ&google_cver=1

Request Chain 273

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YLR4Dk..DxI3DHA9g1UW9wAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHgvLN1DAj7GohL4jtORceQ&google_cver=1&google_hm=2

Request Chain 274

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEKFZx6sVAQzDPEdx5mwzdUU&google_cver=1

Request Chain 275

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzAyOTA3Mjk5OTc5MDgyMTI5OQ%3D%3D

Request Chain 276

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOmNv-2F1zeQ1NIx6yAhFVk&google_cver=1

Request Chain 277

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWEzMGIzMTItMWQ0OC0yN2Q2LWQzYmYtODJmZTJjYzRiNDM4

Request Chain 278

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEE6bfX-y1-Nch_h3prRpj9g&google_cver=1

Request Chain 279

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MTY4ZWMxYzk1YTY1NDRhMzI1OGZkYmJlMTc2NWMwNjVkNTdlZTc3Yg==

Request Chain 280

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDhx_R225u2GfW65wF0Z35A&google_cver=1

Request Chain 281

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_id=74e85e58-c1d3-11eb-8728-12b1ce320106 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NzRlODVkZmQtYzFkMy0xMWViLTg3MjgtMTJiMWNlMzIwMTA2

Request Chain 328

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 329

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 330

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 340

https://hal900017.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=3e70f147b9&subid=&uid=f2f93be0ff40bf05&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7btvDXi0YO6KBoqy3gPnkK3YBuKw3PBf0-zv6fcM8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9CBT9EGQjj7v1D8HtCUq82QGQ3PFDBxvBoXWQ8EjLOVayDWF93e7KxR9I3rKpAoxqCE5txo4-XLMWLyqY4RbKI9dFEIdHAgWKkfM0_MQnd_1-sZrVLlb9RZD9Lqt_RI04qFbCopCO-1VC1iKAlkVdVEnvFXn5sL9FTuChNHywiKZWiPTQb8SuBcgC1dCPFV73Z-xl0QKFx3FGtHcwDTR83aTG7GjSyokBm71sXhWkjtTTKfHjfIL93BK0d8yY6Y8ddKsNl0EFKnQekQmAmK77WP4wbnjYziJivR-mwu26LgxcSKm_fwU6L-fI9Pfl6o0L2txooIzjgJ3ybPC9yyLRjABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoj0YP9TWA234Q8egzIX4xsf6WrQ%26sig%3DAOD64_1BjlleptztDisYjZhJyBbIaDByog%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-CT_QIYuWpd0J-CpxUmvc8W56CklXU083AyXtlzc5ci00qO6TxIQ6P0XR-BXi80wuEF7xCX4erCDbKDlAOv7_45JklWKfCGkJxFMcDUXxY4Hq1K7ckKtSAIm1xegQBZkdlJ0afhWhxgdcjZlNNO-x4uubiHSw%26cry%3D1%26dbm_d%3DAKAmf-AJnnCGM0OwDPSoJS_sWuGJrOY_XNPdCp5Ze-If8_09V28JMqG28Iid8hI-atxVdnN5UsEk0rVKmX8mzgEf8byWB-3RMMtRPESwqzieugnW8E1Pcw9o_dL5f8WW_E71vvbTbzr_EYDWg6ccf_PKZu7V5jkMD_B0a84oI1kSjNUQ_HnAF4KhWUKANyvauF1Gh4jfAmegM6iB6LPbZ2_NReXtOJrEyoC_UkAyaWq6exTZJ68Fv0uhbLmbce6NiAfwuZ96wGVX33F3dD3X5LHKxApakfpFOEJe712x3xbSUotfSgnFlP9ZxcBwASsiP49LjD-Ifx_jhXkZ0uXD8EMbLFxbsMkg5GAxE-1zgChLpEDA8sZqiinlVRtH_gJubtOFoUBgLszzzppFxWvOk-jGB8vifkDQ6L9Gv2OsmloXtxmYzZFMZZp4dncmPTeknU2e581NbfzX1UOdFpEkYAju4C9G7N0TWA%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=6252508110184&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0 HTTP 302
https://hal900017.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=3e70f147b9&subid=&uid=f2f93be0ff40bf05&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7btvDXi0YO6KBoqy3gPnkK3YBuKw3PBf0-zv6fcM8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9CBT9EGQjj7v1D8HtCUq82QGQ3PFDBxvBoXWQ8EjLOVayDWF93e7KxR9I3rKpAoxqCE5txo4-XLMWLyqY4RbKI9dFEIdHAgWKkfM0_MQnd_1-sZrVLlb9RZD9Lqt_RI04qFbCopCO-1VC1iKAlkVdVEnvFXn5sL9FTuChNHywiKZWiPTQb8SuBcgC1dCPFV73Z-xl0QKFx3FGtHcwDTR83aTG7GjSyokBm71sXhWkjtTTKfHjfIL93BK0d8yY6Y8ddKsNl0EFKnQekQmAmK77WP4wbnjYziJivR-mwu26LgxcSKm_fwU6L-fI9Pfl6o0L2txooIzjgJ3ybPC9yyLRjABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoj0YP9TWA234Q8egzIX4xsf6WrQ%26sig%3DAOD64_1BjlleptztDisYjZhJyBbIaDByog%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-CT_QIYuWpd0J-CpxUmvc8W56CklXU083AyXtlzc5ci00qO6TxIQ6P0XR-BXi80wuEF7xCX4erCDbKDlAOv7_45JklWKfCGkJxFMcDUXxY4Hq1K7ckKtSAIm1xegQBZkdlJ0afhWhxgdcjZlNNO-x4uubiHSw%26cry%3D1%26dbm_d%3DAKAmf-AJnnCGM0OwDPSoJS_sWuGJrOY_XNPdCp5Ze-If8_09V28JMqG28Iid8hI-atxVdnN5UsEk0rVKmX8mzgEf8byWB-3RMMtRPESwqzieugnW8E1Pcw9o_dL5f8WW_E71vvbTbzr_EYDWg6ccf_PKZu7V5jkMD_B0a84oI1kSjNUQ_HnAF4KhWUKANyvauF1Gh4jfAmegM6iB6LPbZ2_NReXtOJrEyoC_UkAyaWq6exTZJ68Fv0uhbLmbce6NiAfwuZ96wGVX33F3dD3X5LHKxApakfpFOEJe712x3xbSUotfSgnFlP9ZxcBwASsiP49LjD-Ifx_jhXkZ0uXD8EMbLFxbsMkg5GAxE-1zgChLpEDA8sZqiinlVRtH_gJubtOFoUBgLszzzppFxWvOk-jGB8vifkDQ6L9Gv2OsmloXtxmYzZFMZZp4dncmPTeknU2e581NbfzX1UOdFpEkYAju4C9G7N0TWA%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=6252508110184&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1

Request Chain 341

https://hal900016.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=ecee4080bf&subid=&uid=17259fb160e2ac3c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1st8DXi0YO2KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9A4P9fWJ9jp9aclD4xEu9AADW7w_ppt5K5s-SJpCdNQ5CKJDDnnUymsHIjE7Oa7By0ctQW32rDmu-5OknxG0ekWt3AL4LXVbZ1WfCcxnZYbnM2uFaoEkvtEPaeZIJNazlO87UHarEwYr_eV6uUFPbsmL1b6wAkjc9aB1xX2aMHKmMMN5pkqBajuyQ7a8BSQN9vo956v2loPJsOQFOUoa0jjdgv7gjZEcxbMhMsO6rQpwK-TnFuEdxXwN0kxIPphUNXdxJDov0YNziBAKgAAHMs9U_kBGPQaCb_mp-_LRNN6b2lyDlRABxRu6UtQdTrNhnPdAN8MIvf1jspMEKXLGgnABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoU-TCyfFq2ZGik4BA8xSDkvL8TA%26sig%3DAOD64_3_IW8U_aNaDzRoCnsVuCOeZwDDaQ%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-D48u-kabO6Bywq4Dbgwk05bTkXHVk-RGsqFeAmLX2OSg0lT3C8LXV0lH8jqYvKCClhFx7AkhMsVnXGII-p3Ru8ryJW1HeYPCm88cv5aj3iKpSyGnzqVIlKU7Tah4DZBUdK_ir_n4CgFOffaCdXBQYO1F87kQ%26cry%3D1%26dbm_d%3DAKAmf-A3mBHZnBfbXII5oZrXei1iylGNM0sZ9pbRp6m3_Hw_PM0uNjlODkiUFLNuMqKbKnrUt1bG1FuqPzdLRSsvOG5BHh_BbvBvdY5Xv4waipYlV0YrZHhvW68CGOSZks7M5VaEIunUp0va1zTmE7mBSPdbf5uUUMc4ytcBB9eqVOH-joYp5SCrAJKkS4Ou9bT29nsGalr9Ar7rdYQrt1dbjlkUzqERt4TBMsAmbLqbTSmDTo0tfxnQW9XmYQspKXMjgZE5t5oZ0Kfocdd-QozFCG58oKwLxVRdVh9NKbtJysLGShB6ZYtHP21uqpgsewM-RxLlqLKIaeuo_3c_0mm8EVpX14NVte1jVCG3rWcVBLRlrjiuLscAg0y8Lf-qNr-twZwPh1KcSvF-ohpIfsE4jhKFtSZylQ-2UFJq97Nmuhc3svrwaDnXZnp4vCPghzkdxPMeYrC0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=6723217151045&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0 HTTP 302
https://hal900016.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=ecee4080bf&subid=&uid=17259fb160e2ac3c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1st8DXi0YO2KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9A4P9fWJ9jp9aclD4xEu9AADW7w_ppt5K5s-SJpCdNQ5CKJDDnnUymsHIjE7Oa7By0ctQW32rDmu-5OknxG0ekWt3AL4LXVbZ1WfCcxnZYbnM2uFaoEkvtEPaeZIJNazlO87UHarEwYr_eV6uUFPbsmL1b6wAkjc9aB1xX2aMHKmMMN5pkqBajuyQ7a8BSQN9vo956v2loPJsOQFOUoa0jjdgv7gjZEcxbMhMsO6rQpwK-TnFuEdxXwN0kxIPphUNXdxJDov0YNziBAKgAAHMs9U_kBGPQaCb_mp-_LRNN6b2lyDlRABxRu6UtQdTrNhnPdAN8MIvf1jspMEKXLGgnABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoU-TCyfFq2ZGik4BA8xSDkvL8TA%26sig%3DAOD64_3_IW8U_aNaDzRoCnsVuCOeZwDDaQ%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-D48u-kabO6Bywq4Dbgwk05bTkXHVk-RGsqFeAmLX2OSg0lT3C8LXV0lH8jqYvKCClhFx7AkhMsVnXGII-p3Ru8ryJW1HeYPCm88cv5aj3iKpSyGnzqVIlKU7Tah4DZBUdK_ir_n4CgFOffaCdXBQYO1F87kQ%26cry%3D1%26dbm_d%3DAKAmf-A3mBHZnBfbXII5oZrXei1iylGNM0sZ9pbRp6m3_Hw_PM0uNjlODkiUFLNuMqKbKnrUt1bG1FuqPzdLRSsvOG5BHh_BbvBvdY5Xv4waipYlV0YrZHhvW68CGOSZks7M5VaEIunUp0va1zTmE7mBSPdbf5uUUMc4ytcBB9eqVOH-joYp5SCrAJKkS4Ou9bT29nsGalr9Ar7rdYQrt1dbjlkUzqERt4TBMsAmbLqbTSmDTo0tfxnQW9XmYQspKXMjgZE5t5oZ0Kfocdd-QozFCG58oKwLxVRdVh9NKbtJysLGShB6ZYtHP21uqpgsewM-RxLlqLKIaeuo_3c_0mm8EVpX14NVte1jVCG3rWcVBLRlrjiuLscAg0y8Lf-qNr-twZwPh1KcSvF-ohpIfsE4jhKFtSZylQ-2UFJq97Nmuhc3svrwaDnXZnp4vCPghzkdxPMeYrC0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=6723217151045&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1

Request Chain 342

https://hal90006.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=117e963c18&subid=&uid=55061b47689d8297&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCG3-MDXi0YO-KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9DIXIWgque2KNtCIzNLYcT1-UKc6Om05Opc5F679rQh89xtP07tPsOk8mK9217-aQKWcmPlDhgR6oEkYz1V9F4Oy6J2qwFfXnhJZ_HKrt1XRh2GZPS5LUi-jvZjuEzHX-x2XdgRFYOOsstwha4scqVotbTn3hIMItt8jvLnDfnzYfL0a3iQhfDiJ3svvj-cjScqHDwi171A3oICkF7CSgP3FIc2Ql5WDex1wTbubeMLQZNRsanaKgetURl15Z3eOBB_umEakPEGTHq3io88IkPM3Qrxtcp7YQ_DQhqzXyg5z_5eoDvVriz9fHsu7SYbb7E3Kw89eizQypJ_sf_Kpa7ABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoG0XgkhdZ0QiMU6uU2yIlJ07PmQ%26sig%3DAOD64_37XUHQ7DdajSn_PGsQhjPz4S7K9w%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-AyWQIDgmK7cIPvrzBJB1mgnAfWRqB1iyvGhCrmqedZoqo5pcrwSYbknpYwLLg7iYkHMF150V-aj4y0gGNJhL7v45RB8kO4tJ6fwwBoK46fMnmBQlEQZUPVvX8LARnGMys6XgaFngdN-XJM5rhb0Qpwk2IdaQ%26cry%3D1%26dbm_d%3DAKAmf-AV-GjkGOXP2GI8xSA4b3b-Tv-rxwSmAHLa18z2pT8NXjnlzfmCA7hKTHytA9rT5tOkg0pG6IVY53mswPdAkzNxhUgyTbJnlGvLexXCuRY8CpuS0mXMVwHQsbVUN6vPdRKQ2n8xR-96_M9srsNMFZAA5E4JrgZpGzN7vWdq9dxAudLs_gds14bhv6wUokRtkAVELTACeuZXsNuWb4Ep3lSuLelN7ZTFwvVt_E6rH2wr1d5a8mAXYRKTPZ3GQlAvWLkaJUaPn4HbX_VbcA_ikipbIHAP4UyGDFx7Wvl19HSGy9WwquRtgcTNncn7YWAzHr5p9YkOgZ_vDzlLoKUv_ze9kWS-cUp2RHikX6ZmweAG47ASBY5oVP8FO7xlmKcfY2Svy3ovnv8KOXFVf7xaypHdcIa_DaMBqZc-8hz3aPoqXcS-pPeKqbkX5dP9mw0lfB6c4vsv%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=7926937498705&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0 HTTP 302
https://hal90006.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=117e963c18&subid=&uid=55061b47689d8297&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCG3-MDXi0YO-KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9DIXIWgque2KNtCIzNLYcT1-UKc6Om05Opc5F679rQh89xtP07tPsOk8mK9217-aQKWcmPlDhgR6oEkYz1V9F4Oy6J2qwFfXnhJZ_HKrt1XRh2GZPS5LUi-jvZjuEzHX-x2XdgRFYOOsstwha4scqVotbTn3hIMItt8jvLnDfnzYfL0a3iQhfDiJ3svvj-cjScqHDwi171A3oICkF7CSgP3FIc2Ql5WDex1wTbubeMLQZNRsanaKgetURl15Z3eOBB_umEakPEGTHq3io88IkPM3Qrxtcp7YQ_DQhqzXyg5z_5eoDvVriz9fHsu7SYbb7E3Kw89eizQypJ_sf_Kpa7ABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoG0XgkhdZ0QiMU6uU2yIlJ07PmQ%26sig%3DAOD64_37XUHQ7DdajSn_PGsQhjPz4S7K9w%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-AyWQIDgmK7cIPvrzBJB1mgnAfWRqB1iyvGhCrmqedZoqo5pcrwSYbknpYwLLg7iYkHMF150V-aj4y0gGNJhL7v45RB8kO4tJ6fwwBoK46fMnmBQlEQZUPVvX8LARnGMys6XgaFngdN-XJM5rhb0Qpwk2IdaQ%26cry%3D1%26dbm_d%3DAKAmf-AV-GjkGOXP2GI8xSA4b3b-Tv-rxwSmAHLa18z2pT8NXjnlzfmCA7hKTHytA9rT5tOkg0pG6IVY53mswPdAkzNxhUgyTbJnlGvLexXCuRY8CpuS0mXMVwHQsbVUN6vPdRKQ2n8xR-96_M9srsNMFZAA5E4JrgZpGzN7vWdq9dxAudLs_gds14bhv6wUokRtkAVELTACeuZXsNuWb4Ep3lSuLelN7ZTFwvVt_E6rH2wr1d5a8mAXYRKTPZ3GQlAvWLkaJUaPn4HbX_VbcA_ikipbIHAP4UyGDFx7Wvl19HSGy9WwquRtgcTNncn7YWAzHr5p9YkOgZ_vDzlLoKUv_ze9kWS-cUp2RHikX6ZmweAG47ASBY5oVP8FO7xlmKcfY2Svy3ovnv8KOXFVf7xaypHdcIa_DaMBqZc-8hz3aPoqXcS-pPeKqbkX5dP9mw0lfB6c4vsv%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=7926937498705&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1

Request Chain 360

https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=16167500031559200719608011611016&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png

Request Chain 361

https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=25646200030154900719608011611006&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png

Request Chain 362

https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=93147700025802000719608011611017&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png

Request Chain 365

https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=16167500031559200719608011611016&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif

Request Chain 366

https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=16167500031559200719608011611016&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg

Request Chain 377

https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=25646200030154900719608011611006&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg

Request Chain 378

https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=25646200030154900719608011611006&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif

Request Chain 379

https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=93147700025802000719608011611017&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif

Request Chain 380

https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=93147700025802000719608011611017&t=html HTTP 302
https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg

378 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.manicapost.co.zw/
Redirect Chain

https://manicapost.co.zw/
https://www.manicapost.co.zw/

125 KB
20 KB

865ms
857ms

Document
text/html

2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30a4f0720eb817be3b00a15a067ea8aacd09a129471120efacb038fd90baf746

Request headers

:method: GET
:authority: www.manicapost.co.zw
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-type: text/html; charset=UTF-8
cf-ray: 657de5dc9fdebf0f-FRA
link: <https://www.manicapost.co.zw/wp-json/>; rel="https://api.w.org/"
vary: Accept-Encoding
cf-cache-status: BYPASS
cf-apo-via: origin,no-cache
cf-edge-cache: cache,platform=wordpress
cf-request-id: 0a628dfddc0000bf0f8d1a9000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=7XNkq6cOCc36I3dbJkQ%2BfW%2Fl%2B2w80vOu5j%2FlIkmd156KtHD6G%2Fk5qKlek1iRP2Y8pX18Yhl2mRxidBAWFdVy91VYX0j%2Fl7zw4hbu6SQU%2FWjGWRA6GWKc9sWY7o%2FycWbe2FnXdCfIzgoqkuJSAw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br

Redirect headers

date: Mon, 31 May 2021 05:45:45 GMT
content-type: text/html; charset=UTF-8
location: https://www.manicapost.co.zw/
cf-ray: 657de5d79df6bf0f-FRA
cf-cache-status: BYPASS
cf-apo-via: origin,no-cache
cf-edge-cache: cache,platform=wordpress
cf-request-id: 0a628dfac00000bf0f8b377000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=AG%2FBrqMLxlLagndG0QLJfLeMwFiwcecIDVTXbmh9r%2BNgCNy%2FGTVl%2BUFhVktJJldk3Yqsu%2Bt2bt0%2BI%2Bs55CatDRCiIbuhj7iYSVQwKOMlr%2Fi5qeVI5aECDMzw7XgnvzACppGIP26RWktN"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare

GET
H2 200 sirius.min.css
www.manicapost.co.zw/wp-content/themes/sirius/css/ 36 KB
7 KB 24ms
23ms Stylesheet
text/css 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/css/sirius.min.css
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fcb3079cb44b316e0b00aa6e6f94f43b6f44cd1dc47a0f9ae7d9c0a57b3b5d

Request headers

:path: /wp-content/themes/sirius/css/sirius.min.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Mar 2019 09:28:42 GMT
server: cloudflare
age: 1718277
etag: W/"8e68-584fbf266e924-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gK9hq12JuXFgkOZ5srdF2kUgukSQcP6HTe3Id9DY7FBto%2Fcbtcho%2BaQwf88hH0J8AflbTHPPO5ZOeTB1wLpIIc7WHOZlTwnjju4c%2BN%2BPLehl2l50aqmNjcsaJzZZ7yEpxxpOWpeDJ1ZKOJXqnw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 657de5e1f9eebf0f-FRA
cf-request-id: 0a628e013b0000bf0f5faa6000000001

GET
H2 200 manica_post_logo_small.png
manicapost.zimpapersnetwork.co.zw/wp-content/uploads/sites/20/2019/01/ 4 KB
5 KB 755ms
718ms Image
image/webp 2606:4700:20::ac43:481a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://manicapost.zimpapersnetwork.co.zw/wp-content/uploads/sites/20/2019/01/manica_post_logo_small.png
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:481a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcf6d819952543d324bec7fd2b2ba9bd9c08548bef8c0eb272e5fd24d1080904

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origFmt=png, origSize=7934
content-disposition: inline; filename="manica_post_logo_small.webp"
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4562
cf-request-id: 0a628e0161000096aa4f00c000000001
last-modified: Wed, 30 Jan 2019 12:33:05 GMT
server: cloudflare
etag: "1efe-580ac1c96e96a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lJbR4E2F927S8JBhDKhnxu9hQ1sCi%2BBGPcYI0s5vlecvX1iSSyNmLIbiwvKt%2Fq4kWkoCqqhYPwOM8DC%2FLVzv1RBBZ1O388X0c4pGd%2B98aWOuncmeYH9FtCKeLbXOnq1ECmBaDJczf4%2BNzdvdeNpQtDNSQ3hpE7SBiD0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e23b7496aa-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Shadreck-Mugurasave-50x50.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 1 KB
2 KB 717ms
716ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Shadreck-Mugurasave-50x50.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad2f5c724e0241954f4afc791a93b3dd57852550bcd4c78cbf755e608b0015d0

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Shadreck-Mugurasave-50x50.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=16528, status=webp_bigger
content-length: 1181
cf-request-id: 0a628e013c0000bf0f77027000000001
last-modified: Sun, 30 May 2021 16:27:14 GMT
server: cloudflare
etag: "4090-5c38e94eea6fa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dlh8zi25jqYxCGNwRhQqvYAhhKbIakH6GEMWSixR4VaYDZSZ%2BXU1dGfZA1%2Bkg1iaYVCfUSXipUu9mEQMi78q%2BJDqrBQFuK7LT53wZTqrpZtEsgI%2BrGi%2B4La%2B9gt6gDq%2FG9TnJT9RXQCyGvo%2BiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e1f9f1bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Paul-Mangwana-copy-50x50.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 1 KB
2 KB 712ms
711ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Paul-Mangwana-copy-50x50.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3533d60766873bc3d2762dbe1cf95bde477875a1c84e5713bd0fb55763ba6028

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Paul-Mangwana-copy-50x50.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=11121, status=webp_bigger
content-length: 1345
cf-request-id: 0a628e013d0000bf0f8e3b5000000001
last-modified: Sat, 29 May 2021 18:07:17 GMT
server: cloudflare
etag: "2b71-5c37bdcda8c1a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=eHWcT%2FkjCGR4fDyd3QtyHP6YM3WkpSJdA7tB2bNTr53xbZ%2BEwT9DeS6i8VRxTm1VjaiNt0WoZbMjflJCivL1dlluKyx5zg%2BNezouDcBMr0TZAXOoXZ6XFimf8QRLdEGAdA0JdxMGaJtxN6lsNA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e1f9f2bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Herbert-Maruwa2-50x50.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 1 KB
2 KB 710ms
709ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Herbert-Maruwa2-50x50.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1db8f0f4bf4b81f40329546eb98a57430613cf9252e900ddd1b0dcdfa7a22c2

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Herbert-Maruwa2-50x50.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=9498, status=webp_bigger
content-length: 1143
cf-request-id: 0a628e013d0000bf0f99b02000000001
last-modified: Sat, 29 May 2021 14:27:40 GMT
server: cloudflare
etag: "251a-5c378cb76817e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=KOUpkEy%2B%2F%2FVxhwCwzEwuNEBAbJVue1LczUffolzwue7mPBcURt0KW5X4ESHLfFB59pGsJcsxUPfSXKxH0FECv6VPl5dqYWbrNx5Nn2IDOVHXFpgO9dYfh5%2FSExroX3omzzygiA39TWFi8aI8ww%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e1f9f3bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 sanitary-50x50.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 1 KB
1 KB 717ms
716ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/sanitary-50x50.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5fbc5ee88afc9f9b2aac88a6b37f0f3b112ca732380142b09b0ae13feb4f7d31

Request headers

:path: /wp-content/uploads/sites/20/2021/05/sanitary-50x50.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: status=not_needed
content-length: 1069
cf-request-id: 0a628e013f0000bf0f74b40000000001
last-modified: Thu, 27 May 2021 18:20:13 GMT
server: cloudflare
etag: "42d-5c353cf6c3310"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=TfLqLE23qg1rA56moBLQJ8%2FjigrESerbqew2Ri33sdiWZQS5VsD5Fb9g5Ea7V%2BXMXHzFuvbU%2Bx457%2F0znnkVUcLsEo1hgnMsB3di%2Fjz1ObpvuDRDhU1orsvZDb3Pi4BvD%2FuN8Q44qIoCTUA8Mg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e1f9f4bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Prepositions-50x50.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 2 KB
3 KB 715ms
715ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Prepositions-50x50.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8aea8bef75321784eb5d9250f53130d6aceb4c04aa683f93e4928fc4c9e5f181

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Prepositions-50x50.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=14660, status=webp_bigger
content-length: 2543
cf-request-id: 0a628e013e0000bf0f8d1c8000000001
last-modified: Thu, 27 May 2021 19:37:10 GMT
server: cloudflare
etag: "3944-5c354e29ba160"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=vaeJ9neFDTNm%2B7nbFFsEvYkjVUM0lewYFVZJv3ALP6DlafFFhrDVYgodn4qzHDt%2B4peN1orArS45n8upj4TGjvR30Ssfzpmdt7BjfctX%2B0IK8LkAbGudmSA%2BZYLYGvkw1RqA9ntXkFVCHJH2ug%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e1f9f8bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 preloader_small.gif
www.manicapost.co.zw/wp-content/themes/sirius/img/ 5 KB
5 KB 26ms
26ms Image
image/gif 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/img/preloader_small.gif
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/wp-content/themes/sirius/css/sirius.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5537b8e22d98409891207b8fcdc960a93ac332726529bc8b49a0d161354c0aa

Request headers

:path: /wp-content/themes/sirius/img/preloader_small.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/wp-content/themes/sirius/css/sirius.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/wp-content/themes/sirius/css/sirius.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2169858
cf-polished: origSize=5754, status=webp_bigger
content-length: 4859
cf-request-id: 0a628e01560000bf0f77028000000001
last-modified: Tue, 26 Mar 2019 09:28:45 GMT
server: cloudflare
etag: "167a-584fbf29962f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=shbeuW0KkY4eqGXBT93Y6r2Ps%2BQeI1%2B4E1TyE8nouXB7JVCl%2F7xGueiyowCM0ItyZntzaVqdA%2BHt5SzcrO2VJviJhrWVMUcHOhh1ao3ErTTN1DljKX17UzTrdQflG7SuWulBjzul55UULeWIug%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e22a07bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 exam-680x380.jpeg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 49 KB
49 KB 22ms
22ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/exam-680x380.jpeg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a73ec91499eb126d6264a7980c9cfa90de61123aac408b796db38192db91a1c

Request headers

:path: /wp-content/uploads/sites/20/2021/05/exam-680x380.jpeg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 74089
cf-polished: origSize=51896, status=webp_bigger
content-length: 49924
cf-request-id: 0a628e01710000bf0f95aa3000000001
last-modified: Thu, 27 May 2021 17:26:44 GMT
server: cloudflare
etag: "cab8-5c35310236510"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=TMhpKqr1OjQ3Lm2kaPorZKWZcMq74PyvK%2BQ2hUiqzhyfg8yC6Zn3aERI09WP%2FFtf%2BlPZdH7PyKcrFgzE9d5kEn6m%2Bt34OfqoQnrp5WC%2BoCcmq%2BE5THrUciCzSjMkNMPfa%2BsuO%2B9ejO4zi40pgw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e24a18bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Forbes.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 127 KB
127 KB 20ms
20ms Image
image/webp 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Forbes.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c2b6a232a2b5de7d044e27d3ec8ebd644b2ead821a8cf13f9da01b04b5b1d9b

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Forbes.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 247910
cf-polished: origFmt=jpeg, origSize=228155
content-disposition: inline; filename="Forbes.webp"
content-length: 129606
cf-request-id: 0a628e01890000bf0f8316d000000001
last-modified: Thu, 27 May 2021 17:42:44 GMT
server: cloudflare
etag: "37b3b-5c353495ca414"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Zxb6q4MUvJOnGfHIBA52YTsUDXTzm8RaRH7fmf791iExBSLnAHsbPncqmaA%2FxRI%2BPHelnfhlfL4SsZCM%2FJ%2FG03rGHbYamp3XinrCqouXBeDXr7YwQeN6n%2F8lkNNQGBs1hzAU6MYxeo8s2KzkMA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e27a28bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 vehicles.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 98 KB
99 KB 27ms
26ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/vehicles.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c0f141124c26f9d289be3679ff3d997f802fb5c6ee9088477381f48ba9a3a07

Request headers

:path: /wp-content/uploads/sites/20/2021/05/vehicles.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 74034
cf-polished: origSize=108309, status=webp_bigger
content-length: 100330
cf-request-id: 0a628e018c0000bf0f65159000000001
last-modified: Thu, 27 May 2021 17:35:25 GMT
server: cloudflare
etag: "1a715-5c3532f40360d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ratXmlcmYEIcbSGQF1IfCPK9hnTiYOvflhAobepG9EddPQYvvjVN0Sqv50gATPQME80tp4E9a7kJG3RrPddJLXRshY7z2%2BUSVgiw3SiQcxVyJG7E51MKRgoLsi5Vt48LmKtE23UwnBX2bjX2aA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e27a2ebf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Untitled-6.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2020/12/ 27 KB
28 KB 33ms
33ms Image
image/webp 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2020/12/Untitled-6.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a0436261ea4a2e3414288b2e581316a4eee4139729d62968ce326860938c7a4

Request headers

:path: /wp-content/uploads/sites/20/2020/12/Untitled-6.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 206283
cf-polished: origFmt=jpeg, origSize=600658
content-disposition: inline; filename="Untitled-6.webp"
content-length: 27636
cf-request-id: 0a628e018a0000bf0f988e6000000001
last-modified: Fri, 18 Dec 2020 08:49:38 GMT
server: cloudflare
etag: "92a52-5b6b930418e6f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=TkIIifDO0vL5gNOId32f4mYtk1ym%2BeqA96FNm9vW2abWzH%2BXDMj7RA6Oii%2Fe6mOWU46EVSfLhWUbnBhuUGJ%2FtEDXcIp4AHV5yFfuILgeEpH%2FIKHVEQ5rkYoJVceLzh%2BHIjANwp0l9hKgj47LjA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e27a2abf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 ED-p1-pic-1-200x200.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 8 KB
9 KB 27ms
26ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ED-p1-pic-1-200x200.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 643dac8ae374ed0852585b2459c25f1894ba8b4a2578d0a67d8f3c786c5d4811

Request headers

:path: /wp-content/uploads/sites/20/2021/05/ED-p1-pic-1-200x200.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 206193
cf-polished: origSize=8602, status=webp_bigger
content-length: 8479
cf-request-id: 0a628e018b0000bf0f99108000000001
last-modified: Thu, 20 May 2021 15:45:13 GMT
server: cloudflare
etag: "219a-5c2c4d439ae7d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=a%2BTLLOyycfCXFXkz8H98YvRaHVafKsLLnqAu2eopxeT8rMSvPiT39q7pYybgP%2FopWsQ0aHsfXW%2FsFobm6mvhR7%2B1gb3xOC5ff8Y1gjTgqxZ1hphU1e29SQwGC%2BFYfATDIB3xuuQn9xCfuAG5yQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e27a2bbf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Billboard-ShaSha-200x200.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 16 KB
16 KB 31ms
31ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Billboard-ShaSha-200x200.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 588d5d74a99b8f56a6a93c34ee1376d1c71d87888c21ec3a21cdc192a1bd3a70

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Billboard-ShaSha-200x200.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 251027
cf-polished: origSize=28574, status=webp_bigger
content-length: 15996
cf-request-id: 0a628e01900000bf0f6515a000000001
last-modified: Thu, 27 May 2021 20:54:47 GMT
server: cloudflare
etag: "6f9e-5c355f835f366"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=fCxn4Kth438zC2GJXLxOKdD7pMAUd8ihNA4Trde6IQ3x08x%2FEx4rLKD70X%2FB6rOO6OGdM%2BtwieyLkRKy%2BgCwOAbntbdakmhAItqIhTK4zFO03IS%2BBgkQDAAQJHCL1jmHy1Hni%2B%2Bf5MXMYt1uXA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e27a2fbf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Chipinge.png
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 22 KB
22 KB 26ms
25ms Image
image/webp 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Chipinge.png
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b0d832cc038aa61ee3d925ff03d0dd6456e74707619ffdb5b467442c3d0484b

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Chipinge.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 91978
cf-polished: origFmt=png, origSize=34631
content-disposition: inline; filename="Chipinge.webp"
content-length: 22140
cf-request-id: 0a628e018b0000bf0f910e4000000001
last-modified: Thu, 27 May 2021 07:14:15 GMT
server: cloudflare
etag: "8747-5c34a81c03904"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=3R5LY%2BZqNFSOLU0PPu7LEoxNMm2WauD%2FKFiV08v63qaSYinQrYIDadosRF1Jwv8wesk%2Bvx8VhLFlJB6heZkUT%2BoT30Y6Dt3BklCQKzZXCTa%2FGgEEy5rfI429aGNcYxtox7BFffBkfK7K%2FOKPGw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e27a2cbf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 default_medium.jpg
www.manicapost.co.zw/wp-content/themes/sirius/img/ 1 KB
1 KB 34ms
34ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/img/default_medium.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/wp-content/themes/sirius/css/sirius.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c197a45dc8134b5c126b809a77418d054366de3d18a16ed5733ab7c39c1d8f7

Request headers

:path: /wp-content/themes/sirius/img/default_medium.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/wp-content/themes/sirius/css/sirius.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/wp-content/themes/sirius/css/sirius.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2169857
cf-polished: origSize=2147, status=webp_bigger
content-length: 1053
cf-request-id: 0a628e018b0000bf0f5ea2f000000001
last-modified: Tue, 26 Mar 2019 09:28:45 GMT
server: cloudflare
etag: "863-584fbf29cdd93"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=x%2B436BBWVUWXK7zgrs15ozhHPq%2Ff8awGMFxT9HVVyKqz4cYDg01RRhZvdb7gss18zv7hxXafLoVOVGFZf1WQ5quPnQuQ8WcQ%2BMkbd1FXj%2B2T2Zj1yW%2F0VtRuubBR%2BVzfc7HgsP1DSkWudXcA7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e27a2dbf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 HOMESTYLE-NEWSLETTER-155943.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/04/ 118 KB
119 KB 714ms
713ms Image
image/webp 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/04/HOMESTYLE-NEWSLETTER-155943.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f87757a436d46db2cc03fa7901b5bbdfb2bde93b05c16ef99d046d29e643159

Request headers

:path: /wp-content/uploads/sites/20/2021/04/HOMESTYLE-NEWSLETTER-155943.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origFmt=jpeg, origSize=200775
content-disposition: inline; filename="HOMESTYLE-NEWSLETTER-155943.webp"
content-length: 121210
cf-request-id: 0a628e01e60000bf0f84b17000000001
last-modified: Wed, 21 Apr 2021 07:51:09 GMT
server: cloudflare
etag: "31047-5c076d3731cfd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=3%2BtPQAmMRPF3s3GabJCzhOowXUm5R87gAjNyc8KEyWDESIgHkGYDI8nZrInQ6szFWV4D%2BN6Pa6ia7D8Hzmc6oZwdNd8e4Zaub1sSPgfIJijbEMpqCapHPAzbhfa%2BrNO6%2FvRNma9UzodFZnPzKA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e30a68bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Shadreck-Mugurasave-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 5 KB
5 KB 17ms
15ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Shadreck-Mugurasave-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d55959f187cdb47ac1422c6191b303c98552de1aa114e250b87c0b0444705fb

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Shadreck-Mugurasave-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3019
cf-polished: origSize=20255, status=webp_bigger
content-length: 4727
cf-request-id: 0a628e04040000bf0f5facc000000001
last-modified: Sun, 30 May 2021 16:28:12 GMT
server: cloudflare
etag: "4f1f-5c38e985a421a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=I2by0PBQMK34W0BdScqkOh%2BJsRd4BrQJRGHjkOfQPSYA%2FQJFrSA4BX0YM9FaYLXeXk6MoWggGSJEmoNf3GWgNgITir56K9YieiwKsHYiNax9NvlAKwUcN3W%2ByWFrXEtxUFJQNk1WlgSacDKWWA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e66c27bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Herbert-Maruwa2-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 6 KB
7 KB 22ms
21ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Herbert-Maruwa2-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dbaeed6f465ecf572dfc8d9266cb803b2629c8c726d38e87d271f1c2f64aeed9

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Herbert-Maruwa2-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3019
cf-polished: origSize=14771, status=webp_bigger
content-length: 6361
cf-request-id: 0a628e04040000bf0f798e5000000001
last-modified: Sat, 29 May 2021 14:28:12 GMT
server: cloudflare
etag: "39b3-5c378cd635ce4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LGbh7ulHNKUPlUvgnY9BKaMdnIvgKGVlZvCSWKsq2SaDrpkhIrt3l9avRgbp9WB8hyjp1jmUzoEInFTy6xSKPjq3UQKja3x2oHXhP70iJJCEe%2BgHrO6CvBSVc7S2Goj3dPHyAJNznbDSq7YFeg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e66c2abf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Tennis-Racquet-Picturejpg-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 5 KB
6 KB 723ms
722ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Tennis-Racquet-Picturejpg-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0ce0bf6b6fad9977a41544413cd910987a7bc24289d4b936c5a6281782cde33

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Tennis-Racquet-Picturejpg-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=5591, status=webp_bigger
content-length: 5538
cf-request-id: 0a628e040b0000bf0f84b2f000000001
last-modified: Thu, 27 May 2021 22:02:28 GMT
server: cloudflare
etag: "15d7-5c356ea3cb507"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bSBki9ablfYZlBbXNhZQlGj46ehYrf3s0Ztop8gFPeCr3%2F7Y140zPeTJlkuKQ%2Fv2JLePqMZAnXA1YI6V1Pi17l5Epgg5NDv4Co1N%2BrX2LJ%2BkpYJ22k3Rv1EdLA3hLiMVDRAXhc9ViTvwexnBzA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e67c2cbf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Rugby-trio-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 8 KB
9 KB 719ms
718ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Rugby-trio-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e579163c07bcfb29549653490b1adcb231db63cf75e349445b87857746963a5

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Rugby-trio-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=8628, status=webp_bigger
content-length: 8334
cf-request-id: 0a628e04100000bf0f70816000000001
last-modified: Thu, 27 May 2021 22:02:28 GMT
server: cloudflare
etag: "21b4-5c356ea3d2267"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=QOlJyG%2FxAJY8r6mfTPgUiZ7kAu1AcESbIhXP4jat6H%2F7j86J5%2BzZPUYxKg4PdH1PYbX8WnHCKuw0e53Rcgm1pFpO8NMxnAVqQXl%2B2g0JslPq7avGHCc%2FJFcUqjHQTZHLsdDxx%2BWSTwVPI4oE%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e67c2fbf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Cranborne-Bullets-vs-Tenax-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 11 KB
12 KB 715ms
714ms Image
image/webp 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Cranborne-Bullets-vs-Tenax-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a865f50ddfaabd99f5006d3d1ac0970bb4a3787da131ada7818c300cd5083f2

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Cranborne-Bullets-vs-Tenax-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origFmt=jpeg, origSize=23131
content-disposition: inline; filename="Cranborne-Bullets-vs-Tenax-ml-200x100.webp"
content-length: 11470
cf-request-id: 0a628e040b0000bf0f7400c000000001
last-modified: Thu, 27 May 2021 22:02:28 GMT
server: cloudflare
etag: "5a5b-5c356ea3d9f67"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=V9RtGItCEHM6a2wAtubT9yxZ3qthCkSyZE2E2BY2MMCbZod8a%2F%2Fc6GTdevqrOIqYzLCGyMQNXfTzqavvfuLWOpUTCUYOXp4wBtIJwS5LxqZYPonKCafhbfgh4lTEEmC1gwn8TnRRjtvkOfYIkg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e67c30bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 soccer-2-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 9 KB
9 KB 25ms
24ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/soccer-2-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 371f9015d3e8020505b1d38b78289b9c3cd15ccd16490e49df4d401983a96144

Request headers

:path: /wp-content/uploads/sites/20/2021/05/soccer-2-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:47 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3020
cf-polished: origSize=19776, status=webp_bigger
content-length: 8927
cf-request-id: 0a628e04150000bf0f95abc000000001
last-modified: Thu, 27 May 2021 22:02:28 GMT
server: cloudflare
etag: "4d40-5c356ea3e1c67"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=9cDAD2tpnOI8JvZbXKNLDIr9%2BkqKR25FO73VXMFs9n748xgFJr1XeP7B5rzfiaIJaYczoUEsZi1vKg%2FB7jBE5HFjLHcCES7IMbeSM4yetSJRz3GJZucgd9erAAai0RQGsZraU8Cl2l4klOHC%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e68c34bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Prepositions-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 11 KB
11 KB 723ms
722ms Image
image/webp 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Prepositions-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec7d7284ec7a129ddae5b7c45781cc1ec89f267fb0d860771d3960db2161ff5f

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Prepositions-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origFmt=jpeg, origSize=26300
content-disposition: inline; filename="Prepositions-ml-200x100.webp"
content-length: 10982
cf-request-id: 0a628e041b0000bf0f988fe000000001
last-modified: Thu, 27 May 2021 22:02:33 GMT
server: cloudflare
etag: "66bc-5c356ea945a6c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=S6Usp3R2NX6OU0HG0BF%2FK8iyXrWu1C05sHNNMxUnMsz7Lt7PTZ598vDvEdgVkCm2VsCzE7z9Rxu1RZ%2Fv27S3BeBaBPBdsSyFv3ccwpQ%2BnGQhcb2vDb84UwHYx%2FlVALNMQFwS8ICH24Y5sS3TEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e69c37bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Pronunciation-1-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 12 KB
12 KB 718ms
718ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Pronunciation-1-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed67661232f5dc60bb2701492892a05c0c28027d52c4e1daf6f06179cf19d045

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Pronunciation-1-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=12912, status=webp_bigger
content-length: 12102
cf-request-id: 0a628e042e0000bf0f68bce000000001
last-modified: Thu, 20 May 2021 22:02:27 GMT
server: cloudflare
etag: "3270-5c2ca19525d00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=0ir0h08KT3ySNYRTn9I06jB8d0D%2Ft5kqQiQ%2FEjbRX3yghvYpMVwyHhKP4THQ0TWv90VCJ8eRVWGc1jzbMSOJnyKXl3o1LJAgpX1VDdLORW%2BQ%2FHM2bTM6ny1x2evpMPwv9rX0X7GDEifEpw%2B99Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e6ac41bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Ruins-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 11 KB
12 KB 714ms
714ms Image
image/webp 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Ruins-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73ea11b415ced029d8200d0f08035d8be4a3dcf2888da1e20ed0c5ccbde47d7a

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Ruins-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origFmt=jpeg, origSize=579668
content-disposition: inline; filename="Ruins-ml-200x100.webp"
content-length: 11604
cf-request-id: 0a628e04b10000bf0f731af000000001
last-modified: Thu, 06 May 2021 22:04:37 GMT
server: cloudflare
etag: "8d854-5c1b07f4a2cba"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=7BDpvqvhvd7kNE%2FDoXzBj6leElJq%2Fs7zdMdIH%2B8i7WzltF72uBQCBb8AtUGCq6ctpoXdKHpb9tsEvAtojum2tnzXvilbPlxzROodYZZgtyyf9x9RlD04FCHOOV%2BhHcJMo98S1jt9yIC9s2QYzw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5e78c98bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Homeless-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 8 KB
8 KB 19ms
18ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Homeless-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e798946b8810df00972e68db2f30a553841075a3e9d1672f41de80e711e0876

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Homeless-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 5598
cf-polished: origSize=20827, status=webp_bigger
content-length: 8115
cf-request-id: 0a628e06d60000bf0f74b79000000001
last-modified: Thu, 06 May 2021 22:03:26 GMT
server: cloudflare
etag: "515b-5c1b07b0c6cc8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=WSIa3QA4hyPO2y8uZEuH7%2BNDp5gqo8HWLfBJn6hhQ3ROxebrc7rWEC8jeUNvuHn42xNPob1jIDKgwiacAhK5d1yHTz9JdCQzAkoXJ80vMffHKJnVcBIf7LmVBJ%2F%2BvJwlNe3aZQChUc1BGChv6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5eafe4ebf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 COURT-HAMMER-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2019/04/ 7 KB
7 KB 709ms
709ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2019/04/COURT-HAMMER-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9b6d7609b11db82da8775c91e21fae0ae18a64123cbb6f9cabf7b412bf8b1a3

Request headers

:path: /wp-content/uploads/sites/20/2019/04/COURT-HAMMER-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=6957, status=webp_bigger
content-length: 6853
cf-request-id: 0a628e06d90000bf0f5ea67000000001
last-modified: Thu, 06 May 2021 22:02:28 GMT
server: cloudflare
etag: "1b2d-5c1b0779d955b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=BMlqurT54rjTk9N45RktuDDpaVWmr2zgAFRCBZyKJX6vYeWw%2F48JvcaSdx19UJvzzQK5t%2F41HiyHGqGL7EqhkpDZjgpT48Bn2%2B1xD8zHowBpmtGgzktq%2Fek8INpbjiNphEHKHres9YueXpB0kg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5eafe51bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Muparutsa-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/04/ 5 KB
5 KB 719ms
719ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/04/Muparutsa-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1c146b484122d515e18d872c8c84038fa9c8fcbaa59a006b3f3022866d95c0f

Request headers

:path: /wp-content/uploads/sites/20/2021/04/Muparutsa-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=12412, status=webp_bigger
content-length: 5151
cf-request-id: 0a628e06de0000bf0f8d206000000001
last-modified: Fri, 16 Apr 2021 04:15:53 GMT
server: cloudflare
etag: "307c-5c00f3c5c1ce6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=qylTsMKXfOwDpU3SL%2Bu1%2F6THTWvASTGsAxokpoAC%2BxFkc5j%2BimHR5xxZzQH7nViYR1fmgZWK5FWMkWnMcWZnROyLd%2FUXHDXMO7lzDddaVMl3blPqOk%2FRpwa1sxaj1WgHt9XOkZCCopkcICtGiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5eafe58bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Dola-Indidis-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/04/ 9 KB
10 KB 19ms
18ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/04/Dola-Indidis-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 949bf41ee705bcc14a5ac211f1739a2f7a593e9fdc00758d537502854dacdb80

Request headers

:path: /wp-content/uploads/sites/20/2021/04/Dola-Indidis-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 5598
cf-polished: origSize=19599, status=webp_bigger
content-length: 9704
cf-request-id: 0a628e06ea0000bf0f74b7a000000001
last-modified: Thu, 01 Apr 2021 08:48:16 GMT
server: cloudflare
etag: "4c8f-5bee54ae217fb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=fZ1h0ZI%2BdkHl8aRG6JxM4SLEgXRSODunq9MAwdvujK1vrSgmE9eBzuJVigQbp3l4jBQzIsdn5dGciDOUMgwFMx%2FaPp%2F0%2BcyM9m6gWeuxMYna61gYjjRarlg7nnXr%2BSUZ7NRg%2F0tce6hEi0zf8A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5eb0e63bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Garden-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/04/ 12 KB
12 KB 717ms
717ms Image
image/webp 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/04/Garden-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 92b778b8b56563a4e60c822029684463fb210736470e6233ad2cb34221b655df

Request headers

:path: /wp-content/uploads/sites/20/2021/04/Garden-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origFmt=jpeg, origSize=585321
content-disposition: inline; filename="Garden-ml-200x100.webp"
content-length: 12018
cf-request-id: 0a628e06ee0000bf0f6b129000000001
last-modified: Thu, 01 Apr 2021 08:50:47 GMT
server: cloudflare
etag: "8ee69-5bee553d90269"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=OkmifIfYdkMuLie5QFUD5Fl4U8Rh8yC81%2B9%2F2%2FoH1KmWPthHqM9SQekWD%2B%2B0Kv4VNBU7ct1wtpCEcmR%2BeuInXHhM1VFrIKHY0jXdUv4mFvzVqPaC3%2BCqpOslaHKau5EAdJ1NN0HLUwQ8dieU7g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5eb1e66bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Covid-19-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2020/03/ 8 KB
8 KB 717ms
716ms Image
image/webp 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2020/03/Covid-19-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48118c47e648dbdfd10111a10c110304eef6c5fcbc0019f4e4f3672747f5dc0a

Request headers

:path: /wp-content/uploads/sites/20/2020/03/Covid-19-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origFmt=jpeg, origSize=9082
content-disposition: inline; filename="Covid-19-ml-200x100.webp"
content-length: 7790
cf-request-id: 0a628e06fd0000bf0f6cac3000000001
last-modified: Fri, 06 Nov 2020 05:20:39 GMT
server: cloudflare
etag: "237a-5b3695f8f2fca"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EB%2BcCCqAvFF5r3%2FOmRNiPIMXOVdQA5rVbbazuUeB%2B%2Frox4VTTFaMOh9eiQZunj6t2nH%2Favlmtfss77V21M4kee44PFYleSUzZYhKm0gPU9iWmJ1WE8672QBezrvu2V7uHE3ky9CulanteTvwZw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5eb2e6fbf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Untitled-9-ml-200x100.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2020/09/ 9 KB
9 KB 22ms
22ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2020/09/Untitled-9-ml-200x100.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8371cb46be63803cefac1c7cefb83787810907a2ea9e03a33041251e44cdc0cb

Request headers

:path: /wp-content/uploads/sites/20/2020/09/Untitled-9-ml-200x100.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 5598
cf-polished: origSize=9679, status=webp_bigger
content-length: 9140
cf-request-id: 0a628e06fd0000bf0f8d208000000001
last-modified: Fri, 11 Sep 2020 14:03:38 GMT
server: cloudflare
etag: "25cf-5af0a26cb2aac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=b1NosB%2FNY2vqK2C%2FWcjKQip2MeKFB6So9n2%2BEMylcxLb%2B7dgMilsf7rKB2i7%2BD1PoFnpyjfl0Q8EwQVhMPqMfvrG1NQ0RrdohZnvBVHTaOCBWNFTzAmgZS2WsVl8tfSS07s2naiImlFEL6Eblg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5eb2e70bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 sirius_logo.png
www.manicapost.co.zw/wp-content/themes/sirius/img/ 584 B
1016 B 708ms
707ms Image
image/webp 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/img/sirius_logo.png
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5752d4a50658cddeceb586dccb5713bb9cf91efc2976d79f2a47248c010f192e

Request headers

:path: /wp-content/themes/sirius/img/sirius_logo.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origFmt=png, origSize=1961
content-disposition: inline; filename="sirius_logo.webp"
content-length: 584
cf-request-id: 0a628e07140000bf0f8e3e8000000001
last-modified: Tue, 26 Mar 2019 09:28:45 GMT
server: cloudflare
etag: "7a9-584fbf2993415"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=xCQkLGn3jqj4S2uANzAoN63FwaOv3C%2FkSp2M9HT0A7LGIPtcgExtsnFkSfzsjz%2FLcE3N%2FMNZSOvAkH%2FUyGWFLY1PEpr%2F%2B6dcNhR4pLwVvjnn5tn1F%2FrubvTU7F19Q61GJCDVOFX0Am8izYtHFw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5eb5e79bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 sirius_icons.css
www.manicapost.co.zw/wp-content/themes/sirius/fonts/sirius_icons/ 3 KB
1 KB 29ms
28ms Stylesheet
text/css 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/fonts/sirius_icons/sirius_icons.css
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6d39508164d7015990a918eb8f035aa7040f943a834f028f843046855991fcd

Request headers

:path: /wp-content/themes/sirius/fonts/sirius_icons/sirius_icons.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1718276
cf-polished: origSize=3722
cf-request-id: 0a628e02400000bf0f74b4f000000001
last-modified: Tue, 26 Mar 2019 09:28:49 GMT
server: cloudflare
etag: W/"e8a-584fbf2ded81f-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=1CYnBrcA%2BS005cnG8Nagk1jGjrxo00VJv6N9gIyuYTeLbkKU%2FF0zmXZ90jjai4IwrvCgwV8qUwhlkVAQfh7PwXzACuOGi3zVu1vxADvYNU%2FUvaiQKriG64sCwO%2BmMnM%2BU4UWuoJegU3fJG2RGw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 657de5e39ae6bf0f-FRA
cf-bgj: minify

GET
H2 200 slick.css
www.manicapost.co.zw/wp-content/themes/sirius/js/slick/ 1 KB
889 B 17ms
17ms Stylesheet
text/css 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/js/slick/slick.css
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21061765237c66c10b48e236063a3497c22d33629e98f8654d1a3b860fa48700

Request headers

:path: /wp-content/themes/sirius/js/slick/slick.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1718276
cf-polished: origSize=1776
cf-request-id: 0a628e02720000bf0f74b50000000001
last-modified: Tue, 26 Mar 2019 09:28:48 GMT
server: cloudflare
etag: W/"6f0-584fbf2c78766-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=imK84jRvNbsl4s8pMf80ugQoNFtQFpLmKhMIC3HqbtDl1xuehoE3XpEO9GCITJ5%2BZ%2Fu463JP96Zhy0n%2FtfydecvHrO0%2B4QmKrwgWqGv4xahL%2Bvr0A0xmqVwng2YDrY05yu9UEh%2FaxK1H6H7Ssw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 657de5e3eafdbf0f-FRA
cf-bgj: minify

GET
H2 200 lightgallery.min.css
www.manicapost.co.zw/wp-content/themes/sirius/js/lg/css/ 20 KB
4 KB 21ms
21ms Stylesheet
text/css 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/js/lg/css/lightgallery.min.css
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2b7c76c9afe8eedce734f7d8c524c475c403eef024cf1d4f2e3f92775ff5406

Request headers

:path: /wp-content/themes/sirius/js/lg/css/lightgallery.min.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Mar 2019 09:29:31 GMT
server: cloudflare
age: 2194979
etag: W/"4fea-584fbf5544bff-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zaAoX%2FKaxEgJMhFTG4ELkfr80K2Ed7dfgakp%2FqaMlCboDpUV1Cs%2BzQlqCXUkPoUxRZgejIHa0cZH82IKGlFBu%2F4vFh9DG%2BNKhZxbaMGGE6LfSjA3SZ%2B7LSIR27iRdCOfbG%2BBix8K%2BA4%2BFTNn6g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 657de5e40b0dbf0f-FRA
cf-request-id: 0a628e02840000bf0f95aad000000001

GET
H2 200 lg-transitions.min.css
www.manicapost.co.zw/wp-content/themes/sirius/js/lg/css/ 38 KB
2 KB 37ms
36ms Stylesheet
text/css 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/js/lg/css/lg-transitions.min.css
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2fb6f79d7a4ab0226ce9634cc960a4430c488459219c956d350868b39f20783

Request headers

:path: /wp-content/themes/sirius/js/lg/css/lg-transitions.min.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Mar 2019 09:29:31 GMT
server: cloudflare
age: 2209642
etag: W/"98c4-584fbf5545b9f-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=DiIEbZygqRvnNl61GYs4Q7uGrwF0tyPWS1q9FnLULg05eLoNQgCZmiYveDTkwxuu41Fmk%2B1sbRTodV%2BJ3Tj2ODVw2SlehLPhQJk0H9CGzWqhxrnGeSelnBurX8g23GMswfYdfRkvdFSkHtSM0w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 657de5e42b1bbf0f-FRA
cf-request-id: 0a628e029c0000bf0f77039000000001

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
5 KB 27ms
11ms Script
application/javascript 2606:4700::6810:a823
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a823 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-request-id: 0a628e025000002c015eb38000000001
last-modified: Fri, 28 May 2021 10:23:11 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"60b0c48f-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=TTUqnHPT1f8c%2BJ%2BAcdxWl4s69MHUWtPKa2CHHTwkj856rPGHhlsHdxfnoDP2xrbyN3elXtzvYm871TSrVZPxI9TvLcX27LBa8%2FGWFcb6e4hcQLHpG4fDU1osaYuz%2BkzColnXEeVsCmJsZvH6"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 657de5e3bc252c01-FRA
expires: Wed, 02 Jun 2021 05:45:46 GMT

GET
H2 200 2-c99IRs1JiJN1FRAMjTN5zd9vgsFHX1QjU.woff2
www.manicapost.co.zw/fonts.gstatic.com/s/merriweathersans/v14/ 35 KB
35 KB 54ms
54ms Font
font/woff2 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/fonts.gstatic.com/s/merriweathersans/v14/2-c99IRs1JiJN1FRAMjTN5zd9vgsFHX1QjU.woff2
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2826f9525d9ff7b1d86065eb761da940e70856e239875b04e0e67a7c0edf3d4d

Request headers

:path: /fonts.gstatic.com/s/merriweathersans/v14/2-c99IRs1JiJN1FRAMjTN5zd9vgsFHX1QjU.woff2
pragma: no-cache
origin: https://www.manicapost.co.zw
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.manicapost.co.zw
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 679215
content-length: 35628
cf-request-id: 0a628e02460000bf0f798d7000000001
last-modified: Thu, 28 Jan 2021 20:25:08 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=yyw1PvJ4joSGTJuJoiSnEHy%2BfWgV7mzcaozpn8FQ%2BqMjIBoqdIgmvbs3cEQCVlMawSIwyyY0gvJYbk9emd0vRJvGHuBRm%2FBTNjQG39pCDcFpktLJITiByfCf3pTnM%2Bttg%2B7HNTG%2Br9Uos4%2B5Dg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: public, max-age=2592000
cf-apo-via: proxy
accept-ranges: bytes
cf-ray: 657de5e3aae9bf0f-FRA

GET
H2 200 u-440qyriQwlOrhSvowK_l5-fCZM.woff2
www.manicapost.co.zw/fonts.gstatic.com/s/merriweather/v22/ 19 KB
19 KB 29ms
28ms Font
font/woff2 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZM.woff2
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e19e5fec549d0d871301c8196f4a954abe8d6913464a1ac511f81ef71529f89b

Request headers

:path: /fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZM.woff2
pragma: no-cache
origin: https://www.manicapost.co.zw
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.manicapost.co.zw
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 682467
content-length: 19300
cf-request-id: 0a628e025b0000bf0f6b102000000001
last-modified: Thu, 10 Sep 2020 17:09:53 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Y0drmvx043eUYE0q7DQYALDLDZb8I1mxjFKPpGYnnOaUa6HZrvBxbTpe3i3kbvB027mtdwUy62XpVgvKtcNAQkchZLhuaHnkhjUwkz5ovYFNqMK20sR9%2BNKRXGPdTbvU26EiwhtZcdeMkOVc%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: public, max-age=2592000
cf-apo-via: proxy
accept-ranges: bytes
cf-ray: 657de5e3caf0bf0f-FRA

GET
H2 200 sirius_icons.ttf
www.manicapost.co.zw/wp-content/themes/sirius/fonts/sirius_icons/ 15 KB
8 KB 18ms
18ms Font
application/font-sfnt 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/fonts/sirius_icons/sirius_icons.ttf?1bhu37
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/wp-content/themes/sirius/fonts/sirius_icons/sirius_icons.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: abacfa18472a4ace0034615d9219c5d3585292b5920881c434f7a3382f7cfc57

Request headers

:path: /wp-content/themes/sirius/fonts/sirius_icons/sirius_icons.ttf?1bhu37
pragma: no-cache
origin: https://www.manicapost.co.zw
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/wp-content/themes/sirius/fonts/sirius_icons/sirius_icons.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.manicapost.co.zw
Referer: https://www.manicapost.co.zw/wp-content/themes/sirius/fonts/sirius_icons/sirius_icons.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Mar 2019 09:28:49 GMT
server: cloudflare
age: 5769
etag: W/"3a6c-584fbf2de7a5f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=2FQdKOATnq84qFDmxWkbQ5cOfWMLIclwh71Jcr2q%2FytFhNI6wKpIBFV9%2FG0Xl9wcqrHZysQEuMxuU2Wj%2B477zRF76jaXp0CW6QVrcggDtr%2B8oemfV79kI5fsqCL8582QYxv3N%2F7S2FJW%2B1AKYw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/font-sfnt
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 657de5e3eafebf0f-FRA
cf-request-id: 0a628e02730000bf0f8d1d8000000001

GET
H/1.1 200
OK count.js Show response
the-manica-post.disqus.com/ 1 KB
1 KB 95ms
22ms Script
application/javascript 151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://the-manica-post.disqus.com/count.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 109
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Sun, 30 May 2021 03:41:47 GMT
Server: nginx
ETag: "60b3097b-367"
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
X-Amz-Cf-Pop: DFW3-C1
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: aNLGmerlbJrQnE1-7uRW-Jsl_RnowL7nDZf1lQde1Z44J4VRl3dLrQ==

GET
H2 200 forms-api.min.js Show response
www.manicapost.co.zw/wp-content/plugins/mailchimp-for-wp/assets/js/ 12 KB
4 KB 21ms
19ms Script
application/javascript 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/plugins/mailchimp-for-wp/assets/js/forms-api.min.js?ver=4.1.14
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d915c1a38320682d4c8e6fbe119889d26a91958f472d10808c161f938fc14957

Request headers

:path: /wp-content/plugins/mailchimp-for-wp/assets/js/forms-api.min.js?ver=4.1.14
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 22 Jan 2018 08:55:52 GMT
server: cloudflare
age: 5595
etag: W/"2e73-5635998ece2cb-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=f3JR%2BJYaTGCzRP4yAmweumBHuKVLuozKfENS69ztn2%2BjXQgSBoyyhA1jIU4mCe%2F9LpQfMMpmgBodnrdyk4HuxXFQ8YiDeqgkCuj2iSQ2gS7RxxeJgOfBqRDksoG6HFAnHuQHxgf7MXg5sjW6jw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 657de5e47b37bf0f-FRA
cf-request-id: 0a628e02ca0000bf0f95aaf000000001

GET
H2 200 wp-embed.min.js Show response
www.manicapost.co.zw/wp-includes/js/ 1 KB
1 KB 23ms
22ms Script
application/javascript 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-includes/js/wp-embed.min.js?ver=4.8.17
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 57dd85466749e869c5958a2652e548673557a2390ec68490a353916353ecc74e

Request headers

:path: /wp-includes/js/wp-embed.min.js?ver=4.8.17
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 15 Apr 2021 10:22:51 GMT
server: cloudflare
age: 5595
etag: W/"56a-5c0003eea8ced-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=UmgFG5gENO0jja3lEsWRoBBFtYR0VNkhBp66EueKR5Y1ovkmvW%2BvCr1%2B2%2BSzf6R5J22cSb8L8xB2uxGuS5qsN9yBgPgdkFdqvzxwsbhqlDJzQ%2FI%2B1rTRRwxiRXh4t%2B%2FEGhRf5WNqqNDgWTagkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 657de5e47b39bf0f-FRA
cf-request-id: 0a628e02ca0000bf0f9c313000000001

GET
H2 200 sirius.min.js Show response
www.manicapost.co.zw/wp-content/themes/sirius/js/ 9 KB
3 KB 23ms
22ms Script
application/javascript 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/js/sirius.min.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91d5aee8f0faa85b2ea0c29a0ade99e67256834feed8fd87fb801461061d874c

Request headers

:path: /wp-content/themes/sirius/js/sirius.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Mar 2019 09:28:43 GMT
server: cloudflare
age: 44000
etag: W/"246b-584fbf277f07f-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=nNZ%2F5w7lqqI34nrKjBhQi6RkrqJwRLSZ2Pkip6O%2BbJT8WyT1IEs%2FmtiuSBfPv4ks3gdDMjS9cNmEyEt%2Fo5EmPUDojmp97FcRFguvQ2qD998UvLdP4vybO9UaVt4aB0yLzl37SSQzRXHTSeJgyg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 657de5e47b3abf0f-FRA
cf-request-id: 0a628e02ca0000bf0f99b13000000001

GET
H2 200 lightgallery-all.min.js Show response
www.manicapost.co.zw/wp-content/themes/sirius/js/lg/js/ 48 KB
12 KB 28ms
26ms Script
application/javascript 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/js/lg/js/lightgallery-all.min.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 872fdbf1d445fc24148a4025a848e9c9e7eee31730e98fc218f58b13d28461da

Request headers

:path: /wp-content/themes/sirius/js/lg/js/lightgallery-all.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Mar 2019 09:29:31 GMT
server: cloudflare
age: 2196360
etag: W/"c0a8-584fbf55a85bd-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=w8oV6Z4bixulpEjYjUtS5dcmR0FZXJn0RvqmnT0T1t3%2BNxtN5NVRonfzUv%2BFYa4Q3M6JW1qTVPQ3RqUUrEmf%2FOyXZFPVb%2BJRvp5Lk9yzLze63X5IAG7rTrng%2BX5tYekya01E1IK%2FZwYU%2BTVmPg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 657de5e47b3bbf0f-FRA
cf-request-id: 0a628e02cb0000bf0f910f2000000001

GET
H2 200 slick.min.js Show response
www.manicapost.co.zw/wp-content/themes/sirius/js/slick/ 42 KB
10 KB 23ms
22ms Script
application/javascript 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/js/slick/slick.min.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740

Request headers

:path: /wp-content/themes/sirius/js/slick/slick.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Mar 2019 09:28:48 GMT
server: cloudflare
age: 2169858
etag: W/"a76f-584fbf2ca2746-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wWnwqD38j4VTLtQ%2BcJEi0S8OphfyyVWsP43LecsMZZf8kQkmpwUm9Qxy8xWruqJbv%2FGM%2FvuP8H1L3Oal5nrr4vevpLyfWBuXmfYrtbtYIBZqhjK0IG57CpmipqW74%2F4roBc2lDm9Vdb7OJrcpg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 657de5e47b3cbf0f-FRA
cf-request-id: 0a628e02cb0000bf0f601e6000000001

GET
H2 200 verlok.lazyload.min.js Show response
www.manicapost.co.zw/wp-content/themes/sirius/js/ 3 KB
2 KB 21ms
20ms Script
application/javascript 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/js/verlok.lazyload.min.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f47f8034b4f08f1c4f05a6a914d7ba6fe966a0112d5ec0cbbae2cd7b35b6407b

Request headers

:path: /wp-content/themes/sirius/js/verlok.lazyload.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Mar 2019 09:28:42 GMT
server: cloudflare
age: 2198394
etag: W/"dcd-584fbf273d9a0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2B3q4E44I3df1aP94xBnMIkJusMnlrvQ%2FLfsAoPsOPz%2FyMVYNcGdHKUz0cp1Qw1JDr4YJVhSypVQqXACR7gVyyP%2FOQk0hKud1Cig6eXCHrRiHiOpOXvS%2FyQpoeM6qOjmtm1%2FrFr1rDCN%2FHNF4aA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 657de5e47b3dbf0f-FRA
cf-request-id: 0a628e02cb0000bf0f74b53000000001

GET
H2 200 jquery-3.2.1.min.js Show response
www.manicapost.co.zw/wp-content/themes/sirius/js/ 85 KB
29 KB 28ms
27ms Script
application/javascript 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.manicapost.co.zw/wp-content/themes/sirius/js/jquery-3.2.1.min.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

:path: /wp-content/themes/sirius/js/jquery-3.2.1.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Mar 2019 09:28:43 GMT
server: cloudflare
age: 2169706
etag: W/"15283-584fbf276b7ff-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=736Uhn3zj1wkDsr6yGb4%2FQztCQBoOrT21RcujPyyZDh5JModigyL%2BfeNrirXSbdZERVatnbaKdNeGlpax7azWZBzhL0P0kh%2FRUW2EO48PTjaMlFtrFQPgxyuexcmFgsCoeJFurG7SsD3lZmIcg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 657de5e47b3ebf0f-FRA
cf-request-id: 0a628e02cc0000bf0f988f3000000001

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 134 KB
47 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df356f8aa91e7f14dc79f22056218dddc3b711545e6d5d2d1e72eaa17b052f1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48356
x-xss-protection: 0
server: cafe
etag: 3890051329819667200
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 31 May 2021 05:45:46 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 62 KB
21 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed8fd5966c1d769a76d49fe6929becc99ca387a013c2bbed13165f9e5bfb315c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "888 / 101 of 1000 / last-modified: 1622153345"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21426
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:46 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 80 KB
32 KB 17ms
16ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PQPJHM8

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

637db90a032f52478a681e2d23ef6435d81107bbcf6b6f827912bba541783368

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32285
x-xss-protection: 0
last-modified: Mon, 31 May 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 31 May 2021 05:45:48 GMT

GET
H2 200 pubads_impl_2021052401.js Show response
securepubads.g.doubleclick.net/gpt/ 309 KB
109 KB 80ms
29ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

6aa7181afe0bea9dc4e90e1d040c0b27be388088f6a5ec3d195c60229fe3c9b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 May 2021 08:37:29 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 110966
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:48 GMT

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/ 232 KB
86 KB 40ms
38ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-3993920789177136&plah=www.manicapost.co.zw&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d7401bef80e31a1aa3a2d1daab189dfba7f02a21e7cfef216e011f0c05a74da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87658
x-xss-protection: 0
server: cafe
etag: 5316214545020586774
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 31 May 2021 05:45:48 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210524/r20190131/ Frame ACBF 10 KB
4 KB 6ms
5ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210524/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1dad6cb9a0903898a8f82f89c0d10ee6e94f8459228530fa5df3078100c9f650

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210524/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 30 May 2021 20:29:24 GMT
expires: Sun, 13 Jun 2021 20:29:24 GMT
content-type: text/html; charset=UTF-8
etag: 15349191498103243965
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4506
x-xss-protection: 0
age: 33384
cache-control: public, max-age=1209600
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK count.js Show response
the-manica-post.disqus.com/ 1 KB
1 KB 23ms
22ms Script
application/javascript 151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://the-manica-post.disqus.com/count.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:48 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 111
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Sun, 30 May 2021 03:41:47 GMT
Server: nginx
ETag: "60b3097b-367"
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
X-Amz-Cf-Pop: DFW3-C1
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: aNLGmerlbJrQnE1-7uRW-Jsl_RnowL7nDZf1lQde1Z44J4VRl3dLrQ==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PQPJHM8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 4736
date: Mon, 31 May 2021 04:26:52 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Mon, 31 May 2021 06:26:52 GMT

GET
H/1.1 200
OK count-data.js Show response
the-manica-post.disqus.com/ 1 KB
2 KB 130ms
116ms Script
application/javascript 151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://the-manica-post.disqus.com/count-data.js?2=https%3A%2F%2Fwww.manicapost.co.zw%2Fa-giant-awakens%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Fbattle-of-soldiers-stalemate-at-sakubva%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Fbrave-woman-fights-off-robber%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Fcivil-servants-abuse-vehicle-import-scheme%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Fcoursework-for-nov-2021-exams%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Fending-period-poverty-2%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Ffrom-dusty-streets-of-dangamvura-to-america%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Fgirls-eclipse-boys-in-tennis-playing%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Fgovt-redesigns-forbes-border-post%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Fmutare-trio-in-women-sables-camp%2F

Requested by

Host: the-manica-post.disqus.com
URL: https://the-manica-post.disqus.com/count.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5cfd937ed1b27066b87c8094ab74379f47391e00f74876aee67729dbf3d9dd22

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:48 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 143
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary: Accept-Encoding
Cache-Control: public, max-age=600
Connection: keep-alive
Content-Type: application/javascript; charset=UTF-8
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 1101
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK count-data.js Show response
the-manica-post.disqus.com/ 649 B
1 KB 160ms
114ms Script
application/javascript 151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://the-manica-post.disqus.com/count-data.js?2=https%3A%2F%2Fwww.manicapost.co.zw%2Fpolad-discusses-electoral-reforms%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Fschoolgirls-to-get-sanitary-wear%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Ftenax-stand-tall-in-mutare-derby%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Funderstanding-prepositions%2F&2=https%3A%2F%2Fwww.manicapost.co.zw%2Fzim-turning-a-corner-prof-ncube%2F

Requested by

Host: the-manica-post.disqus.com
URL: https://the-manica-post.disqus.com/count.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f9d8458e2ec4210b3ca49e6ea499c1eb919dad2a8e79a0cdc2ce5e39cc045dc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:48 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 143
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary: Accept-Encoding
Cache-Control: public, max-age=600
Connection: keep-alive
Content-Type: application/javascript; charset=UTF-8
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 649
X-XSS-Protection: 1; mode=block

GET
H2 200 ED-p1-pic-1-200x200.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 8 KB
9 KB 19ms
18ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ED-p1-pic-1-200x200.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 643dac8ae374ed0852585b2459c25f1894ba8b4a2578d0a67d8f3c786c5d4811

Request headers

:path: /wp-content/uploads/sites/20/2021/05/ED-p1-pic-1-200x200.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 206195
cf-polished: origSize=8602, status=webp_bigger
content-length: 8479
cf-request-id: 0a628e0a330000bf0f8b00c000000001
last-modified: Thu, 20 May 2021 15:45:13 GMT
server: cloudflare
etag: "219a-5c2c4d439ae7d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=os7iEm7uJK%2BdFpC7%2ByjtMJ%2F7yvPgpApopqu8e50oGVsfd%2FF9kv2H0HQwvEgJuPfH%2FZnf11k5hU3R8G4oKXHRhXGDNdEAQwJZxveZvRDIbzVA6AWUcbN7MUK9tMaGM5qh9J3gREGu7X2pxu%2B6pw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5f05860bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Billboard-ShaSha-200x200.jpg
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 16 KB
16 KB 25ms
25ms Image
image/jpeg 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Billboard-ShaSha-200x200.jpg
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 588d5d74a99b8f56a6a93c34ee1376d1c71d87888c21ec3a21cdc192a1bd3a70

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Billboard-ShaSha-200x200.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 251029
cf-polished: origSize=28574, status=webp_bigger
content-length: 15996
cf-request-id: 0a628e0a330000bf0f731e6000000001
last-modified: Thu, 27 May 2021 20:54:47 GMT
server: cloudflare
etag: "6f9e-5c355f835f366"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=fWDO%2B3LvNKPLn9Wttq7zWRCKgCY7PMhmMbO%2BWpuXVTHr%2B%2BRdJIE2vG8A7Ttti7wsF4qTNJRk%2FARDGvwGZCansnmmJWLl5SRqU5t4Q8Fkh7xbe0E5iVpekPHjJ73u02KzNTQVz1WwgqZhNgS%2FMg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5f05862bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Chipinge.png
www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/ 22 KB
22 KB 20ms
20ms Image
image/webp 2606:4700:20::681a:534
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.manicapost.co.zw/wp-content/uploads/sites/20/2021/05/Chipinge.png
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:534 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b0d832cc038aa61ee3d925ff03d0dd6456e74707619ffdb5b467442c3d0484b

Request headers

:path: /wp-content/uploads/sites/20/2021/05/Chipinge.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.manicapost.co.zw
referer: https://www.manicapost.co.zw/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 91980
cf-polished: origFmt=png, origSize=34631
content-disposition: inline; filename="Chipinge.webp"
content-length: 22140
cf-request-id: 0a628e0a340000bf0f5fb02000000001
last-modified: Thu, 27 May 2021 07:14:15 GMT
server: cloudflare
etag: "8747-5c34a81c03904"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Wf8S5pQLon4lvC6QG4exKJRMoyhkF9UoSwuKmGh0j%2FEDZtLglev6Fsam1EGpH7CR61aCimfkHcOL%2BP6EpeS%2FgUf3%2FqVHMPRlsU5wreQFhbtUQt1oUDNyxz9wubssDjDlm4lGIrrjlbofBOul%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 657de5f05863bf0f-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 / Show response
www.youtube.com/embed/ Frame C24B 30 KB
10 KB 57ms
37ms Document
text/html 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/wp-content/themes/sirius/js/verlok.lazyload.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

be42ad9dda1b210eba319a24037d4c6e1d509b09b888c4cae1b575c77f0848f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 31 May 2021 05:45:48 GMT
strict-transport-security: max-age=31536000
permissions-policy: ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: YSC=zUKUmKeco6A; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none VISITOR_INFO1_LIVE=ZsKmm9mJN_c; Domain=.youtube.com; Expires=Sat, 27-Nov-2021 05:45:48 GMT; Path=/; Secure; HttpOnly; SameSite=none CONSENT=PENDING+478; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com; Secure
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 13ms
13ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=345128359&t=pageview&_s=1&dl=https%3A%2F%2Fwww.manicapost.co.zw%2F&ul=en-us&de=UTF-8&dt=The%20ManicaPost%20%7C%20Hot%20News%20From%20The%20East&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=25560581&gjid=479984147&cid=1849769312.1622439949&tid=UA-70141858-5&_gid=462749118.1622439949&_r=1&gtm=2wg5q1PQPJHM8&z=107821964

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.manicapost.co.zw
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 206 B
411 B 32ms
31ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.manicapost.co.zw&callback=_gfp_s_&client=ca-pub-3993920789177136

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-3993920789177136&plah=www.manicapost.co.zw&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

fa7f92d274816a80d3fb8065565e8e4fc023eea6541e37bf4bb4acb198bcf9a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 195
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.manicapost.co.zw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 May 2021 05:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.manicapost.co.zw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 May 2021 05:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C9A3 66 KB
25 KB 226ms
225ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3988215234&adk=2335021192&adf=2830833273&pi=t.ma~as.3988215234&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948798&bpp=3&bdt=2247&idt=74&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&correlator=1441014396034&frm=20&pv=2&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=2608&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=XimnFqFLYM&p=https%3A//www.manicapost.co.zw&dtd=124

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f032dca5ec03847710c3980a7aa116553d73308002235649cf4f63536efa7f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3988215234&adk=2335021192&adf=2830833273&pi=t.ma~as.3988215234&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948798&bpp=3&bdt=2247&idt=74&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&correlator=1441014396034&frm=20&pv=2&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=2608&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=XimnFqFLYM&p=https%3A//www.manicapost.co.zw&dtd=124
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 31 May 2021 05:45:49 GMT
server: cafe
content-length: 25223
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 31-May-2021 06:00:48 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 31 May 2021 05:45:49 GMT
cache-control: private

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 28ms
27ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210524&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

26eaf5f6865956e4e726318f9891001f9870e4cd0b8469cd2673f89bbcfed690

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 May 2021 05:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7695
x-xss-protection: 0

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 29ms
14ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f359cea41f7e97a585f44c7c318c4f2314b2981060da1623e39d8d348ff9150

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028727180027"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27990
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:48 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9DD9 66 KB
24 KB 280ms
279ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

510fa6edd1c44740a6496b2be796e5846ab6ff3a3406378e83b2888c62ff2a62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 31 May 2021 05:45:49 GMT
server: cafe
content-length: 25033
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 31-May-2021 06:00:48 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 31 May 2021 05:45:49 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6B0B 66 KB
25 KB 282ms
281ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=9292512808&adk=53181682&adf=1550776291&pi=t.ma~as.9292512808&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948802&bpp=1&bdt=2251&idt=138&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148%2C680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=4580&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=5wI7VeVUOy&p=https%3A//www.manicapost.co.zw&dtd=140

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

318d8bd7b35d023bb4987aab6dfc52500e840677619ba79e413e1c3981ee4254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=9292512808&adk=53181682&adf=1550776291&pi=t.ma~as.9292512808&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948802&bpp=1&bdt=2251&idt=138&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148%2C680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=4580&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=5wI7VeVUOy&p=https%3A//www.manicapost.co.zw&dtd=140
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 31 May 2021 05:45:49 GMT
server: cafe
content-length: 25145
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 31-May-2021 06:00:48 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 31 May 2021 05:45:49 GMT
cache-control: private

GET
H3-29 200 www-player-webp.css
www.youtube.com/s/player/0b643cd1/ Frame C24B 356 KB
45 KB 22ms
8ms Stylesheet
text/css 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0b643cd1/www-player-webp.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5b5fab3b788b3161871e2509cbaaa55f9b73fae0aae0459211269320f11ab5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 27 May 2021 14:45:58 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 27 May 2021 00:23:20 GMT
server: sffe
age: 313190
vary: Accept-Encoding, Origin
content-type: text/css
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46118
x-xss-protection: 0
expires: Fri, 27 May 2022 14:45:58 GMT

GET
H3-29 200 www-embed-player.js Show response
www.youtube.com/s/player/0b643cd1/www-embed-player.vflset/ Frame C24B 193 KB
64 KB 32ms
19ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0b643cd1/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8883a14e28c43192e52a115f6abc8f72909088d49d13752a913816614c984a31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 20:21:23 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 27 May 2021 00:23:20 GMT
server: sffe
age: 33865
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65035
x-xss-protection: 0
expires: Mon, 30 May 2022 20:21:23 GMT

GET
H3-29 200 base.js Show response
www.youtube.com/s/player/0b643cd1/player_ias.vflset/en_US/ Frame C24B 2 MB
466 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0b643cd1/player_ias.vflset/en_US/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5cd7b3a4c5496d4c699526a6882f4a609682c49ffe34462ac9be3304b97bb62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 05:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 27 May 2021 00:23:20 GMT
server: sffe
age: 86850
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 477374
x-xss-protection: 0
expires: Mon, 30 May 2022 05:38:18 GMT

GET
H3-29 200 fetch-polyfill.js Show response
www.youtube.com/s/player/0b643cd1/fetch-polyfill.vflset/ Frame C24B 8 KB
3 KB 34ms
21ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0b643cd1/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 20:06:35 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 27 May 2021 00:23:20 GMT
server: sffe
age: 34753
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2830
x-xss-protection: 0
expires: Mon, 30 May 2022 20:06:35 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame C24B 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.youtube.com
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 21:46:00 GMT
x-content-type-options: nosniff
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
age: 460788
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
expires: Wed, 25 May 2022 21:46:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 28ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.manicapost.co.zw

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 May 2021 05:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 30ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.manicapost.co.zw

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 May 2021 05:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 780 KB
135 KB 1116ms
1084ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=126145367883815&correlator=3269824343426697&output=ldjh&impl=fifs&eid=31060784%2C31060978%2C31061311%2C31061029&vrg=2021052401&ptt=17&sc=1&sfv=1-0-38&ecs=20210531&iu_parts=35406761%2Czp_manicapost_mercury%2Czp_manicapost_venus%2Czp_manicapost_takeover_3%2Czp_manicapost_takeover_5%2Czp_manicapost_takeover_sol%2Czp_manicapost_takeover_2%2Czp_manicapost_takeover_1%2Czp_manicapost_takeover_4%2Czp_manicapost_earth%2Czp_manicapost_halley%2Czp_manicapost_saturn%2Czp_manicapost_jupiter%2Czp_manicapost_charon%2Czp_manicapost_uranus%2Czp_manicapost_ganymede%2Czp_manicapost_titan%2Czp_manicapost_callisto%2Czp_manicapost_lo%2Czp_manicapost_europa%2Czp_manicapost_triton%2Czp_manicapost_pluto&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8%2C%2F0%2F9%2C%2F0%2F10%2C%2F0%2F11%2C%2F0%2F12%2C%2F0%2F13%2C%2F0%2F14%2C%2F0%2F15%2C%2F0%2F16%2C%2F0%2F17%2C%2F0%2F18%2C%2F0%2F19%2C%2F0%2F20%2C%2F0%2F21&prev_iu_szs=320x100%2C320x100%2C1920x900%2C1920x900%2C1920x900%2C1920x900%2C1920x900%2C1920x900%2C160x600%2C728x90%2C728x90%2C728x90%2C728x90%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C320x100&cookie=ID%3Db5952aeb8a19fa04-2296b2ee58c800fe%3AT%3D1622439948%3ART%3D1622439948%3AS%3DALNI_MYctW0KfM2oGCk-eStVn648JdKTGg&bc=31&abxe=1&lmt=1622439948&dt=1622439948971&dlt=1622439946551&idt=2398&frm=20&biw=1600&bih=1200&oid=3&adxs=666%2C1008%2C-9%2C-9%2C0%2C-9%2C-9%2C-9%2C1150%2C-9%2C250%2C250%2C250%2C991%2C991%2C991%2C991%2C-12245933%2C-12245933%2C-12245933%2C-9&adys=67%2C67%2C-9%2C-9%2C37%2C-9%2C-9%2C-9%2C268%2C-9%2C1472%2C918%2C7678%2C2289%2C4178%2C5802%2C7318%2C-12245933%2C-12245933%2C-12245933%2C-9&adks=1981791554%2C1537623070%2C361908417%2C1251406085%2C4168856661%2C1264531331%2C2348638639%2C1580002282%2C473129356%2C2587579999%2C2684107333%2C1552125888%2C1515745337%2C1524226991%2C946108293%2C2932076331%2C1128624373%2C3208982529%2C745233492%2C4154305292%2C1273253342&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf%7Cg%7Ch%7Ci%7Cj%7Ck%7Cl&ifi=7&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=320x100%7C320x100%7C0x-1%7C0x-1%7C1600x0%7C0x-1%7C0x-1%7C0x-1%7C180x600%7C0x-1%7C1100x0%7C1100x0%7C1100x0%7C339x280%7C339x280%7C339x280%7C339x280%7C0x0%7C0x0%7C0x0%7C0x-1&msz=320x-1%7C320x-1%7C0x-1%7C0x-1%7C1600x0%7C0x-1%7C0x-1%7C0x-1%7C160x-1%7C0x-1%7C1100x0%7C1100x0%7C1100x0%7C336x-1%7C336x-1%7C336x-1%7C336x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=false&fws=0%2C0%2C2%2C2%2C4%2C2%2C2%2C2%2C0%2C2%2C0%2C0%2C0%2C4%2C4%2C4%2C4%2C132%2C132%2C132%2C2&ohw=0%2C0%2C0%2C0%2C1600%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C360%2C360%2C360%2C360%2C360%2C360%2C360%2C0&btvi=0%7C0%7C-1%7C-1%7C0%7C-1%7C-1%7C-1%7C0%7C-1%7C1%7C0%7C2%7C3%7C4%7C5%7C6%7C-1%7C-1%7C-1%7C-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

94170b47dff76034358f283ac264b75627044a2e85fd320e008e1d2e64e76ae8

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKvF1-ab8_ACFQqZdwodZ0gLaw&gqi=&layout=/sadbundle/%24csp%253Der3%24/15338438512577467951/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKnF1-ab8_ACFQqZdwodZ0gLaw&gqi=&layout=/sadbundle/%24csp%253Der3%24/11829745323518310093/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKrF1-ab8_ACFQqZdwodZ0gLaw&gqi=&layout=/sadbundle/%24csp%253Der3%24/11829745323518310093/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKvF1-ab8_ACFQqZdwodZ0gLaw&gqi=&layout=/sadbundle/%24csp%253Der3%24/15338438512577467951/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKnF1-ab8_ACFQqZdwodZ0gLaw&gqi=&layout=/sadbundle/%24csp%253Der3%24/11829745323518310093/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKrF1-ab8_ACFQqZdwodZ0gLaw&gqi=&layout=/sadbundle/%24csp%253Der3%24/11829745323518310093/index.html
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2
google-creative-id: 138301724707,-2,138350418708,-1,-1,-1,-1,-1,-1,138301378856,-2,-1,-2,-1,-1,-1,-1,-1,-1,-1,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 138357
x-xss-protection: 0
google-lineitem-id: 5281378496,-2,5700681769,-1,-1,-1,-1,-1,-1,5281378496,-2,-1,-2,-1,-1,-1,-1,-1,-1,-1,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
date: Mon, 31 May 2021 05:45:50 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.manicapost.co.zw
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 64ms
14ms Other
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-38/html/ 0
0 12ms
5ms Other
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 16ms
13ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:48 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 35DF 20 KB
1 KB 56ms
55ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&adk=1309968118&adf=3288313458&lmt=1622439948&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948826&bpp=1&bdt=2275&idt=164&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db5952aeb8a19fa04-2296b2ee58c800fe%3AT%3D1622439948%3ART%3D1622439948%3AS%3DALNI_MYctW0KfM2oGCk-eStVn648JdKTGg&prev_fmts=680x148%2C680x148%2C680x148&nras=1&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=6&uci=a!6&fsb=1&dtd=174

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ab93c4304ded96166e02e7ef20fa37d04a4526c7e8591589ce930087a752d797

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3993920789177136&output=html&adk=1309968118&adf=3288313458&lmt=1622439948&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948826&bpp=1&bdt=2275&idt=164&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db5952aeb8a19fa04-2296b2ee58c800fe%3AT%3D1622439948%3ART%3D1622439948%3AS%3DALNI_MYctW0KfM2oGCk-eStVn648JdKTGg&prev_fmts=680x148%2C680x148%2C680x148&nras=1&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=6&uci=a!6&fsb=1&dtd=174
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 31 May 2021 05:45:49 GMT
server: cafe
content-length: 1369
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 31-May-2021 06:00:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 31 May 2021 05:45:49 GMT
cache-control: private

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame E0AF 12 KB
5 KB 15ms
12ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Mon, 31 May 2021 03:52:39 GMT
expires: Tue, 31 May 2022 03:52:39 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 6790
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E44D 783 B
763 B 21ms
19ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

746f5c9128d286367df2610b35f95de047b40692a5a37a668ac7204af416ec6b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dzAIv75UAYBUuB0uNLhBEA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

expires: Mon, 31 May 2021 05:45:49 GMT
date: Mon, 31 May 2021 05:45:49 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-dzAIv75UAYBUuB0uNLhBEA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 id Show response
googleads.g.doubleclick.net/pagead/ Frame C24B 113 B
161 B 14ms
14ms XHR
application/json 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0b643cd1/www-embed-player.vflset/www-embed-player.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34dee9e8aff2d559516be5101700234798d955c65924b5a45ebcfefded7ab8bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame C24B 29 B
407 B 26ms
6ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0b643cd1/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:41:03 GMT
x-content-type-options: nosniff
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
age: 286
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
expires: Mon, 31 May 2021 05:56:03 GMT

GET
H3-29 200 remote.js Show response
www.youtube.com/s/player/0b643cd1/player_ias.vflset/en_US/ Frame C24B 98 KB
30 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0b643cd1/player_ias.vflset/en_US/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0b643cd1/player_ias.vflset/en_US/base.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

168850c920ff331bd5d294b1a84972f74fa847bc89fd7a2d70b5e1480d2728c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 29 May 2021 16:34:32 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 27 May 2021 00:23:20 GMT
server: sffe
age: 133877
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30984
x-xss-protection: 0
expires: Sun, 29 May 2022 16:34:32 GMT

GET
H3-29 200 embed.js Show response
www.youtube.com/s/player/0b643cd1/player_ias.vflset/en_US/ Frame C24B 25 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0b643cd1/player_ias.vflset/en_US/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0b643cd1/player_ias.vflset/en_US/base.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc8995800462e967657ce7a6d242f5226c5e0bdb2ca9e9947f238078b7566bce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 04:08:44 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 27 May 2021 00:23:20 GMT
server: sffe
age: 5825
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7471
x-xss-protection: 0
expires: Tue, 31 May 2022 04:08:44 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 39ms
39ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_success&c=0&wpc=ca-pub-3993920789177136&warn=12%2C13&w=1600&h=1200&eatf=false&reatf=true&a=6%2C1%2C5%2C7&apv=20210526_103840&sat=1622220870682&afm=0&as_count=5&d_count=7&ng_count=0&am_count=0&atf_count=3&mdns=0.328&alldns=0.328&allp=66&pgh=8186&su=www.manicapost.co.zw&r=0.1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame C24B 4 KB
2 KB 33ms
13ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0b643cd1/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:49 GMT

GET
H3-29 200 13235976426988887145
tpc.googlesyndication.com/simgad/ Frame C9A3 20 KB
20 KB 7ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13235976426988887145?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qn0-9NQEx5LSAMFw9Pc0BxaEF4Y_Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3988215234&adk=2335021192&adf=2830833273&pi=t.ma~as.3988215234&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948798&bpp=3&bdt=2247&idt=74&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&correlator=1441014396034&frm=20&pv=2&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=2608&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=XimnFqFLYM&p=https%3A//www.manicapost.co.zw&dtd=124

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b31995cb054e2340132dcf4d5740eed33295786d075c689641e1cf82b026c283

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 19:54:17 GMT
x-content-type-options: nosniff
last-modified: Wed, 03 Mar 2021 12:51:24 GMT
server: sffe
age: 553892
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20886
x-xss-protection: 0
expires: Tue, 24 May 2022 19:54:17 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/ Frame C9A3 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4cc755a99349527933df50f5338a02d972da947a4c25f4a5309f4545ddc40ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:35:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 641
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7025
x-xss-protection: 0
server: cafe
etag: 8821855511435206686
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:35:08 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame C9A3 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:45:04 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C9A3 121 KB
37 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e45ca14bc59eff23fa77a56b5a047910b4bb21832fb69ef9308c3e16caabbe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028738751036"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37763
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:49 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame C9A3 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

684722f2ec67f3a1b4aad3b445dd37b60d048d66701dfff1f5c40b3bad4fae8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1319581658596578636
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:44:38 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame C9A3 25 KB
10 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a656137c96d7c5550298220b3583603d6342a582bb53251bdcc52dace3716d4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 03:48:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7027
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10532
x-xss-protection: 0
server: cafe
etag: 13485069350837860933
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 03:48:42 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame C9A3 0
0 18ms
17ms Fetch
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C5RFJDHi0YIb8OcuBbMWBlIAEnp3yi2HhsdrTwQ3b2R4QASCBtfkpYJUCoAGioO_zA8gBAqkC2tqn4Hx0tD6oAwHIA8kEqgTiAU_QRhSlv6SaHZMI3NBBHkkqT_xs4vJnRcqk5Lu-q5K8zmqeeiAI8b4CxfDVpDFZJ7_kJ3XNP3ziGNCRpAEG2U7ROt83Qf2KbCLEOSohhcQOeQtknqDnSmEtEpQx2P0zlehQgO85bdQaPt_Udxcn6GU5cvw50lIQL6CVpGukiwlOcr_ooztInXdYrC7ohD43qoaQHoMPuZa3OW0_zl9xdYzgJRRdtPCOLVTfpr6OB8Y_lkX5pBAHpeOMJ4Vfu1Ei2FMARpl333GBC7KzX1cTMBjDz3okpiBL-sUTMjW8Oo03wmrABLLas8mRApIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYCgAfG35AMqAeKnLECqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEL6VAtIICQiA4YAQEAEYH4AKAcgLAdgTDdAVAYAXAbIXGgoYCAASFHB1Yi0zOTkzOTIwNzg5MTc3MTM2&sigh=sLqm87DMO9g

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3988215234&adk=2335021192&adf=2830833273&pi=t.ma~as.3988215234&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948798&bpp=3&bdt=2247&idt=74&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&correlator=1441014396034&frm=20&pv=2&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=2608&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=XimnFqFLYM&p=https%3A//www.manicapost.co.zw&dtd=124
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 31 May 2021 05:45:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js Show response
pagead2.googlesyndication.com/bg/ Frame E0AF 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03f14357b2de695aa54c32f6aa655da2e30c383035c0cead7234c80517f7740b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 17 May 2021 11:28:00 GMT
server: sffe
age: 35281
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5771
x-xss-protection: 0
expires: Mon, 30 May 2022 19:57:48 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4E30 143 B
163 B 7ms
6ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3988215234&adk=2335021192&adf=2830833273&pi=t.ma~as.3988215234&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948798&bpp=3&bdt=2247&idt=74&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&correlator=1441014396034&frm=20&pv=2&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=2608&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=XimnFqFLYM&p=https%3A//www.manicapost.co.zw&dtd=124
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUklQZ45su1vnuhKqhRgEHgbqVCuXL5-s_siccLoGWqea8bhwvplYqHVcNd8; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3988215234&adk=2335021192&adf=2830833273&pi=t.ma~as.3988215234&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948798&bpp=3&bdt=2247&idt=74&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&correlator=1441014396034&frm=20&pv=2&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=2608&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=XimnFqFLYM&p=https%3A//www.manicapost.co.zw&dtd=124

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 31 May 2021 05:29:22 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 987
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 redir.html Show response
p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 13D9 247 B
787 B 191ms
66ms Document
text/html 142.250.180.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.180.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s33-in-f3.1e100.net

Software

sffe /

Resource Hash

7d28ee8b4225eb077cb9d4d7152b064fc1a3820ea25b6d5c85e9157786206745

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com
:scheme: https
:path: /v6exp3/redir.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-XqSuVRLTSWLkLXrUpvhi_g' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
content-length: 201
date: Mon, 31 May 2021 05:45:49 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Mon, 02 Dec 2019 20:15:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C9A3 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 35dfa46c308e2121eb39b0ebc575c737aa2c38c84ecca012ef197ee594bc3865

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 9148745148688764273
tpc.googlesyndication.com/simgad/ Frame 9DD9 13 KB
13 KB 7ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9148745148688764273?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmDH2exiFM293nY4fKvf3IdtFUgmQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

17728cc9705dbac47eefce9b0573f0c902952ca76e0f1da2cf5cf7bedd9eb90b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 27 May 2021 10:12:50 GMT
x-content-type-options: nosniff
last-modified: Fri, 30 Apr 2021 16:05:07 GMT
server: sffe
age: 329579
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13243
x-xss-protection: 0
expires: Fri, 27 May 2022 10:12:50 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/ Frame 9DD9 17 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4cc755a99349527933df50f5338a02d972da947a4c25f4a5309f4545ddc40ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:35:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 641
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7025
x-xss-protection: 0
server: cafe
etag: 8821855511435206686
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:35:08 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 9DD9 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:45:04 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9DD9 121 KB
37 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e45ca14bc59eff23fa77a56b5a047910b4bb21832fb69ef9308c3e16caabbe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028738751036"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37763
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:49 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 9DD9 13 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

684722f2ec67f3a1b4aad3b445dd37b60d048d66701dfff1f5c40b3bad4fae8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1319581658596578636
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:44:38 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 9DD9 25 KB
10 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a656137c96d7c5550298220b3583603d6342a582bb53251bdcc52dace3716d4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 03:48:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7027
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10532
x-xss-protection: 0
server: cafe
etag: 13485069350837860933
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 03:48:42 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 9DD9 0
0 16ms
16ms Fetch
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CGB3_DHi0YISNOtW_bI21iogGs9Gv-WKv176DzQ2khZPAsAEQASCBtfkpYJUCoAHR_fW1AcgBAqkCNB1pnC3Ptz6oAwHIA8kEqgTpAU_QbDoaDZwtKzJOGCmc94ZzsWOX0h_ri1wsRFZyFrhyIvYxdVnshKi0SlQszJkb_Es0iLEfIzS5uoU4KjkP1djV7moeRWJVthQeyfTwx3b14yWlBCHGBjhensQjMw_HExhFgtShz58C51h1n-jXESU812vWQeWEQKelkwaVQ-UYHBfmqKjype4ZExd8dIwVPD-tC29MJu-Whb1s4xiX1LfvdMsenddQVv6FtSAfxJhfIo-gkNPhqI90yemZXYDGPg1Kq68ziabtwOADveDDP3bHJtr8KllzB9MlIqwoELL0HpoR19o2d5pVwATe9pvqwAOSBQQIBBgBkgUECAUYBKAGAoAHl4KKygKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQy7QG0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBgBcBshcaChgIABIUcHViLTM5OTM5MjA3ODkxNzcxMzY&sigh=TsMapy-1T7M

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 31 May 2021 05:45:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 77EB 143 B
163 B 8ms
6ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUklQZ45su1vnuhKqhRgEHgbqVCuXL5-s_siccLoGWqea8bhwvplYqHVcNd8; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 31 May 2021 05:29:22 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 987
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4E30
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

14ms
14ms

Document
text/html

2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUklQZ45su1vnuhKqhRgEHgbqVCuXL5-s_siccLoGWqea8bhwvplYqHVcNd8; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:49 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 31-May-2021 06:45:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 31 May 2021 05:45:49 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:49 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 15437007387735761736
tpc.googlesyndication.com/simgad/ Frame 6B0B 14 KB
15 KB 10ms
8ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15437007387735761736?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkqsiaRXI1mvq4injFhC9W2KnVyTw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=9292512808&adk=53181682&adf=1550776291&pi=t.ma~as.9292512808&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948802&bpp=1&bdt=2251&idt=138&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148%2C680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=4580&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=5wI7VeVUOy&p=https%3A//www.manicapost.co.zw&dtd=140

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7293ed82c0d8a87f8c60dcb6598ff06270b2bf370adc318099a17d2d430d556d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 14:21:10 GMT
x-content-type-options: nosniff
last-modified: Mon, 21 Sep 2020 14:33:17 GMT
server: sffe
age: 55479
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14845
x-xss-protection: 0
expires: Mon, 30 May 2022 14:21:10 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/ Frame 6B0B 17 KB
7 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4cc755a99349527933df50f5338a02d972da947a4c25f4a5309f4545ddc40ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:35:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 641
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7025
x-xss-protection: 0
server: cafe
etag: 8821855511435206686
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:35:08 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 6B0B 2 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:45:04 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6B0B 121 KB
37 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e45ca14bc59eff23fa77a56b5a047910b4bb21832fb69ef9308c3e16caabbe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028738751036"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37763
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:49 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 6B0B 13 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

684722f2ec67f3a1b4aad3b445dd37b60d048d66701dfff1f5c40b3bad4fae8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1319581658596578636
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:44:38 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 6B0B 25 KB
10 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a656137c96d7c5550298220b3583603d6342a582bb53251bdcc52dace3716d4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 03:48:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7027
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10532
x-xss-protection: 0
server: cafe
etag: 13485069350837860933
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 03:48:42 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6B0B 0
0 18ms
17ms Fetch
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cb8xNDHi0YPC_OtO3bqqjg_gI6cmHlFqc27PXlg7b2R4QASCBtfkpYJUCoAHatPyBA8gBAqkC2tqn4Hx0tD6oAwHIA8kEqgTrAU_QudAGNKje2rdyzyht7s_3pIkzny1-o2vTx34oFYXiV-NOwxgXw_Bf1Ix-7ahjuT6OJZkoPyqApXdt5lFziqMhax4-QaQ9LFPnSen5MWTq6O_o2hpyiKxN3d1xJrKuawi75-G9EgqYMXclvCgTXyth7PM0fYkJK18CLFouarbjw57aTQzTNK5fpdN_1rDf2jHOYH--OaEfrrhNJ7tQAWQRcJkb2QoFVloRcYoSH-IsWvRHd6MFEFRg21A-vdJ6Sw4R4Uz6oBBu2lHI0gyfxjggWb9-_49gGipdKJmHrIvayCUEMWZvODnnKzjABMvu6IujApIFBAgEGAGSBQQIBRgEoAYCgAeOy4N-qAeKnLECqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEELHvCtIICQiA4YAQEAEYH4AKAcgLAdgTDdAVAYAXAbIXGgoYCAASFHB1Yi0zOTkzOTIwNzg5MTc3MTM2&sigh=cJbLRH7ZZ28

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=9292512808&adk=53181682&adf=1550776291&pi=t.ma~as.9292512808&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948802&bpp=1&bdt=2251&idt=138&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148%2C680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=4580&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=5wI7VeVUOy&p=https%3A//www.manicapost.co.zw&dtd=140
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 31 May 2021 05:45:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9DD9 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b501be064399eb54a71980273ffb3966fa51e9979b45420e24774be52954e6c6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6F58 143 B
163 B 7ms
6ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=9292512808&adk=53181682&adf=1550776291&pi=t.ma~as.9292512808&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948802&bpp=1&bdt=2251&idt=138&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148%2C680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=4580&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=5wI7VeVUOy&p=https%3A//www.manicapost.co.zw&dtd=140
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUklQZ45su1vnuhKqhRgEHgbqVCuXL5-s_siccLoGWqea8bhwvplYqHVcNd8; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=9292512808&adk=53181682&adf=1550776291&pi=t.ma~as.9292512808&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948802&bpp=1&bdt=2251&idt=138&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148%2C680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=4580&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=5wI7VeVUOy&p=https%3A//www.manicapost.co.zw&dtd=140

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 31 May 2021 05:29:22 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 987
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 6B0B 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1518f05598970997d55127b09b77a4b3e5e5fbdb080b993ef03140f404489e17

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 77EB
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

14ms
14ms

Document
text/html

2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUklQZ45su1vnuhKqhRgEHgbqVCuXL5-s_siccLoGWqea8bhwvplYqHVcNd8; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:49 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 31-May-2021 06:45:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 31 May 2021 05:45:49 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:49 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js Show response
pagead2.googlesyndication.com/bg/ Frame CA63 14 KB
6 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3993920789177136&output=html&h=148&slotname=3488563923&adk=3449525129&adf=3913784623&pi=t.ma~as.3488563923&w=680&lmt=1622439948&rafmt=11&psa=0&format=680x148&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439948801&bpp=1&bdt=2251&idt=131&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=680x148&correlator=1441014396034&frm=20&pv=1&ga_vid=1849769312.1622439949&ga_sid=1622439949&ga_hid=345128359&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=270&ady=3646&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671&oid=3&pvsid=126145367883815&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=R88odyQiYN&p=https%3A//www.manicapost.co.zw&dtd=134

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03f14357b2de695aa54c32f6aa655da2e30c383035c0cead7234c80517f7740b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 17 May 2021 11:28:00 GMT
server: sffe
age: 35281
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5771
x-xss-protection: 0
expires: Mon, 30 May 2022 19:57:48 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6F58
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

14ms
14ms

Document
text/html

2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUklQZ45su1vnuhKqhRgEHgbqVCuXL5-s_siccLoGWqea8bhwvplYqHVcNd8; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:49 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 31-May-2021 06:45:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 31 May 2021 05:45:49 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:49 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js Show response
pagead2.googlesyndication.com/bg/ Frame 5B76 14 KB
6 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03f14357b2de695aa54c32f6aa655da2e30c383035c0cead7234c80517f7740b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 17 May 2021 11:28:00 GMT
server: sffe
age: 35281
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5771
x-xss-protection: 0
expires: Mon, 30 May 2022 19:57:48 GMT

GET
H3-29 200 iframe.html Show response
p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 13D9 4 KB
2 KB 124ms
67ms Document
text/html 142.250.180.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.180.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s33-in-f3.1e100.net

Software

sffe /

Resource Hash

f4cf42168880ed241a3e4c58cf7ae0ed789abbe0e5839bd0c3490409a3e7847b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com
:scheme: https
:path: /v6exp3/iframe.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce---9cp8Ok9-a54nR3jLP--g' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
content-length: 1862
date: Mon, 31 May 2021 05:45:49 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Thu, 29 Apr 2021 21:38:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gda_r20210524&jk=126145367883815&bg=!x8SlxIDNAAaMan2LjGo7ACkAdvg8WhQWt8eDHugxaTyMuKJicDEKwH6TOd2v4vtYfoktQZz7__znUwIAAACtUgAAAAxoAQcKASS6hDIJVGIiPbEJT2Isb9T8ItqgtNTcOFRCU03J4lYoNOc3DBJVh6faroLuLcB0nQ8iuxqj95EJ_jwWGLXpa4mgjc6LWFk1rQdSwclp9Bf8j64cFWGCZeIxG0L4YfifRJ8Zyy-9qfeFi3InjNa9SGvr4cBsQJpzHiBrMypRTkSfPd7vkn4dywsFAxZmGhjggRpfo5pzKdjreVckSStZUj3QfmNuhNJ8OaefZaybutNbTjlwWDlGanZnsxAZbJIQ7ZIrRpyJpAitTGLcKwxpdriSLBQL0gUrboQe3d3CxWEEimJ0s4Lj4Hm1xprOBTRZ-bpS-9BoKeiynNsWwBVJdXhThS2JqOzM7PRRFV3xFOuKW6gBZbymHD4sAxRIhfjX6I_WKi70mQJF2WXUGf_kYfpRRyKaJnWj0eJOsz_wvoDrrw3eV2UlxoopiU2k4XyEuPDaefmxaiDp-T3Rl-sYu_AacQ9ZVUi_l4zNPi2Io3FTIjCrJmJLbLt4IuXEMxf2klla5aUIIB6_hRMezzyRn-NdW9sW04Y196vjzWE7zu_yRI7NrOufS3mF0CfZ7B8qvYyJd1ufj1Ge7eksIRv940Q9QqK8OipITbT5_6pRZYGKD6vM2p01qPAkHYGaozrcvxCzqOepQ2wLS1m8JHoyzrDGM73D9qyLK74h3-_GgAGoDh8sOcgbb5Tc01-xn7dQAhKG2xVcAEkXFe6QjtgQkeIIyEQUFtbDGdUiJBDzCAioGRUC3JnilUjp7Bh3yHW6l_3e1GSy5h36AV0HqUX6EKzB0Bp22A1PM4O1icUOVY4PkcaR6ZofuXAfoV_6kfZec1MnCC-jeIJc2Huv_mMCF_KYRo3SL24GvMPmNKLbvPVgGoudwKedEof_mcKdKYApiGSzP6Jfnlr2PQ7aZkhVrA3bEEglVwLhAmgq_TcUaaDGPE1eC7QpYI1IvD3NRwd5BP20UaMqyE75Ual0sg6mTR4CfS0MVlbHkIHFM8_KBSKT6Cu92v8YRf_ICW0OcFOGrhlbV2U4eJSam-ses4StZxweUhlcITgn3BU4lQePc2gNqS84sk0tPS5Y5mCfEc3n4cP3N5Io-OAbmjZXSbyM6cEg8KhqQxVtrMg0w5kq5P9maTKSJ9PdX4DYkrRdA7W9x81W3rtFrQpsHudPhXI

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js Show response
pagead2.googlesyndication.com/bg/ Frame C670 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03f14357b2de695aa54c32f6aa655da2e30c383035c0cead7234c80517f7740b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 20:42:03 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 17 May 2021 11:28:00 GMT
server: sffe
age: 32626
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5771
x-xss-protection: 0
expires: Mon, 30 May 2022 20:42:03 GMT

GET
H3-29 200 view
securepubads.g.doubleclick.net/pcs/ Frame A74B 0
0 31ms
31ms Fetch
image/gif 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu5DTBHyycQsTjGnm308ggOKhiSRcYkeN2sHIlr-3LzITPNaAMsg71YNq8eHdr-TKFbexeir0pLb6BBzr5wW3eOgoyiEIAmtuTrcaxCKGiPMeho18_sVL8xRJ2MHV_15WebaH_IC9StjYzyInCTTfuLgEeBnOtURcU3lxeeimjWTSURamgemJHpy11KMDR3z_nbk26NyxC4OlfWxxswHLEE1FhdL9E1f5jvKH3tK0G5-k3GeZUTAxkYoBXGBT5C6XNjSmx-xp3xPJW3JacjXjMhbg9zUiIdrpRG9x665kx7e1k9LKUmA8X05hU&sai=AMfl-YQylEgUwNYQJCoYa6UbfpFEMA8nfLuYhHLHqFpUCBFMsbsxYKUWdLChU9LTk2RgVIlqZkSIGLN7jLeYniA2wwmFYXDHnUz9vP-Q2XN3OPW_KQahlROL0FXBNiqC7THI&sig=Cg0ArKJSzLIbPKvJ_TxJEAE&urlfix=1&adurl=

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H3-29 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame A74B 90 KB
32 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb731be92c4bfe2360141c42a987ee49e2191ed75e2efff0dcc42e1882d6da7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32965
x-xss-protection: 0
server: cafe
etag: 1977833837501118871
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A74B 121 KB
37 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e45ca14bc59eff23fa77a56b5a047910b4bb21832fb69ef9308c3e16caabbe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028738751036"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37763
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012104130153000/ Frame DD90 192 KB
55 KB 30ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

842c872b3898f5b0e7d31292eebc5442195611e262f59bae3e7d5b63c507e00d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149309
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55414
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "806d9da51f0ab461"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:21 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame DD90 12 KB
5 KB 77ms
54ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3d84be67c0c5be9cfca5550b4bcc0947d40d62806652b81f7c296bfbc427357

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4561
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f7d3159bb96ed225"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame DD90 88 KB
27 KB 77ms
55ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb759faf67697ba0b5359e9574f85b1fe60574b6d96fce3df6eaf102501b107c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27392
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "025b1bcedb95d6d9"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame DD90 4 KB
2 KB 82ms
60ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7139c86828ab90555f59fbccbf0209ed8da1f5498ba5d78f80c3b189f38e705

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1546
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "26e8fee94434f5d6"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame DD90 40 KB
13 KB 83ms
61ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7bc29500273c93c58829591b68df2cd5b8885409f82654d852b5b9b65d18f7be

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149310
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12750
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "73bdf441b447cfc6"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:20 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame DD90 3 KB
674 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 31 May 2021 05:19:10 GMT
server: ESF
date: Mon, 31 May 2021 05:45:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/6704209667466293934/ Frame DD90 36 KB
36 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6704209667466293934/downsize_200k_v1?w=600&h=314

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b1f8ddab278293c9f219cc4f4a92b7a8391b3029e53aaba6bb10c4638bac1770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 29 May 2021 15:02:13 GMT
x-content-type-options: nosniff
age: 139417
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36453
x-xss-protection: 0
last-modified: Mon, 17 May 2021 06:15:01 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 15:02:13 GMT

GET
DATA 200
OK truncated
/ Frame DD90 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame DD90 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 16be77b01cf84090ac9788dc760f450c79375fcd9a4e72784fc6ce50160e8434

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012104130153000/ Frame 6F98 192 KB
54 KB 30ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

842c872b3898f5b0e7d31292eebc5442195611e262f59bae3e7d5b63c507e00d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149309
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55414
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "806d9da51f0ab461"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:21 GMT

GET
H3-29 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 6F98 12 KB
4 KB 26ms
11ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3d84be67c0c5be9cfca5550b4bcc0947d40d62806652b81f7c296bfbc427357

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4561
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f7d3159bb96ed225"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H3-29 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 6F98 88 KB
27 KB 29ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb759faf67697ba0b5359e9574f85b1fe60574b6d96fce3df6eaf102501b107c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27392
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "025b1bcedb95d6d9"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H3-29 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 6F98 4 KB
2 KB 32ms
16ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7139c86828ab90555f59fbccbf0209ed8da1f5498ba5d78f80c3b189f38e705

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1546
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "26e8fee94434f5d6"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H3-29 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 6F98 40 KB
12 KB 24ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7bc29500273c93c58829591b68df2cd5b8885409f82654d852b5b9b65d18f7be

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149310
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12750
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "73bdf441b447cfc6"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:20 GMT

GET
DATA 200
OK truncated
/ Frame 6F98 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 24c45402a6bdca80e9fad73f60536dd27ec52bc3bb9e2b751e1d3f92d91d9c62

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012104130153000/ Frame 1F4C 192 KB
54 KB 29ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

842c872b3898f5b0e7d31292eebc5442195611e262f59bae3e7d5b63c507e00d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149309
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55414
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "806d9da51f0ab461"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:21 GMT

GET
H3-29 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 1F4C 12 KB
4 KB 23ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3d84be67c0c5be9cfca5550b4bcc0947d40d62806652b81f7c296bfbc427357

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4561
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f7d3159bb96ed225"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H3-29 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 1F4C 88 KB
27 KB 27ms
11ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb759faf67697ba0b5359e9574f85b1fe60574b6d96fce3df6eaf102501b107c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27392
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "025b1bcedb95d6d9"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H3-29 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 1F4C 4 KB
2 KB 23ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7139c86828ab90555f59fbccbf0209ed8da1f5498ba5d78f80c3b189f38e705

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1546
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "26e8fee94434f5d6"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H3-29 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 1F4C 40 KB
12 KB 21ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7bc29500273c93c58829591b68df2cd5b8885409f82654d852b5b9b65d18f7be

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149310
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12750
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "73bdf441b447cfc6"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:20 GMT

GET
DATA 200
OK truncated
/ Frame 1F4C 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 68bdfa8f9127be3622b9fc437a0a0173855fc86a7245d0f322af2b479294d198

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 container.html Show response
d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9049 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 31 May 2021 05:45:49 GMT
expires: Tue, 31 May 2022 05:45:49 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B4E0 6 KB
3 KB 22ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 31 May 2021 05:45:49 GMT
expires: Tue, 31 May 2022 05:45:49 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2362 6 KB
3 KB 16ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 31 May 2021 05:45:49 GMT
expires: Tue, 31 May 2022 05:45:49 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012104130153000/ Frame 8211 192 KB
54 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

842c872b3898f5b0e7d31292eebc5442195611e262f59bae3e7d5b63c507e00d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149309
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55414
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "806d9da51f0ab461"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:21 GMT

GET
H3-29 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 8211 12 KB
4 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3d84be67c0c5be9cfca5550b4bcc0947d40d62806652b81f7c296bfbc427357

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4561
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f7d3159bb96ed225"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H3-29 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 8211 88 KB
27 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb759faf67697ba0b5359e9574f85b1fe60574b6d96fce3df6eaf102501b107c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27392
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "025b1bcedb95d6d9"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H3-29 200 amp-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 8211 70 KB
16 KB 13ms
10ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-animation-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4ea481478fd717638f959064b535f8a86209ee418b3ff5715f23ff9756da6e6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 325954
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16326
x-xss-protection: 0
server: sffe
date: Thu, 27 May 2021 11:13:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d02693399f6b80d6"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 27 May 2022 11:13:16 GMT

GET
H3-29 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 8211 4 KB
2 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7139c86828ab90555f59fbccbf0209ed8da1f5498ba5d78f80c3b189f38e705

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149311
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1546
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "26e8fee94434f5d6"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:19 GMT

GET
H3-29 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012104130153000/v0/ Frame 8211 40 KB
12 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012104130153000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7bc29500273c93c58829591b68df2cd5b8885409f82654d852b5b9b65d18f7be

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 149310
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12750
x-xss-protection: 0
server: sffe
date: Sat, 29 May 2021 12:17:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "73bdf441b447cfc6"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 12:17:20 GMT

GET
DATA 200
OK truncated
/ Frame 8211 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ea09650d614da1e0b7ab0bcfb61fb69e84e4bfce41f3a7e897db8858c7b1f842

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 user_uploaded_miso_700_normal.ttf
tpc.googlesyndication.com/sadbundle/9517118105585293401/fonts/ Frame 8211 24 KB
24 KB 64ms
51ms Font
application/octet-stream 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/9517118105585293401/fonts/user_uploaded_miso_700_normal.ttf

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ccf9f06e011a933f85a99067952719fbeec992c04d89dd1c2b40763a0bc5812b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.manicapost.co.zw
Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
last-modified: Wed, 05 May 2021 13:21:26 GMT
server: sffe
x-dns-prefetch-control: off
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24572
x-xss-protection: 0
expires: Tue, 31 May 2022 05:45:50 GMT

GET
H3-29 200 container.html Show response
d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9877 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 31 May 2021 05:45:49 GMT
expires: Tue, 31 May 2022 05:45:49 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 670F 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 31 May 2021 05:45:49 GMT
expires: Tue, 31 May 2022 05:45:49 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9B19 6 KB
3 KB 9ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 31 May 2021 05:45:49 GMT
expires: Tue, 31 May 2022 05:45:49 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame DD90 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 14:36:54 GMT
x-content-type-options: nosniff
server: cafe
age: 54536
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 31 May 2021 14:36:54 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame DD90 295 B
319 B 8ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 22:17:05 GMT
x-content-type-options: nosniff
server: cafe
age: 26925
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 May 2021 22:17:05 GMT

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame DD90 0
0 34ms
32ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CgiVpDXi0YOCKBoqy3gPnkK3YBtOIvttippLX6bwNj7Da9OkjEAEggbX5KWCRhICA-BegAfnX0d8CyAEJqQLa2qfgfHS0PuACAKgDAcgDCqoEpgJP0Bj7pVSC_yx7KVheCLKKgUuJkIa6DUngMOFrzM8q6VXcu7jWvLFKgOFBveZ-BidYh0q7jcQ5E3yd1OZOoS7K9mOpe8Rlz9RaSzOte8tPHbf_r5FgQA2Hev1A9HlqLl4qCdmegLubhktOoNDqRbcyZZwv7cV2pBnI89k_T49RlUScVOo83IPlTgYOHVRL9Kh5DSVIlw2QzhYC57Ixj18abOebVqdaH8vTPjA1shcTUjhZDkZxQkPegLhNoE-i4E4i3cdKWid_dHcL2OPD__fUa4ZBN37YA0Uhil6cCMmFhNfJ4WpXZkJTi026HQz6Rod_Qd7Tomohnyj08Fpsfyud8vfiZ9fqyPDpXNc5vfAeUX7HKw0pZpj8K_m5dTL2KJVAM_NlrxXABL-h-fm-A-AEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAfvp66gAagHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBDFwAbSCAkIiOGAEBABGB2ACgHICwG4E4gn2BMNiBQK0BUBgBcBshcaChgIABIUcHViLTM5OTM5MjA3ODkxNzcxMzY&sigh=69xNCL6ZGOE&template_id=5000
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 4585298385342408497
tpc.googlesyndication.com/simgad/ Frame 6F98 40 KB
40 KB 12ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4585298385342408497?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qm4i3QpCDomOObqCQp7n8IN5r_rrA

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cde74d28de3cfa3e76df590e6d952450621bf0934cd7ceaa4501404680fc61f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 28 May 2021 04:44:13 GMT
x-content-type-options: nosniff
last-modified: Thu, 25 Mar 2021 19:17:31 GMT
server: sffe
age: 262897
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40698
x-xss-protection: 0
expires: Sat, 28 May 2022 04:44:13 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6F98 2 KB
2 KB 8ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 14:36:54 GMT
x-content-type-options: nosniff
server: cafe
age: 54536
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 31 May 2021 14:36:54 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6F98 295 B
319 B 8ms
5ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 22:17:05 GMT
x-content-type-options: nosniff
server: cafe
age: 26925
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 May 2021 22:17:05 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 6F98 0
0 22ms
17ms Image
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT0mFcn4gAgDnbjTM-IvPPhxVNsTL4nQOa96uRn4-2RXlRitVsfN898uzq043092P-ZTMmpoKqjknO-1thOtpRDn_bkvw
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 6F98 0
0 35ms
31ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CteDyDXi0YOSKBoqy3gPnkK3YBtLrkINi7PDJxZ0N5pLI-oAiEAEggbX5KWCRhICA-BegAYzm5sICyAECqQLa2qfgfHS0PuACAKgDAcgDCKoEnwJP0FbHAMBtIcFHayRAzWENnBWFur2DMciKUHtH5BrseSkQYXNuR9mfuo6wILj-HEn1Ztou5SGVoLZUtX5VdgQqpvxhZ4qWHTwJuDj-rIq-U1rGjAHXfqDOWPX3tcdOAkWjs7yorGPwLMZblo0V0T2yuAa0FwxMfxQYg1UzP5pUp3hGz5YtU1fWKFbpfIr4tLh_iAxVdrV06R_Og-MQt9wOemJhQcvSU65ti4QcxuMxJqUdI0aglDaQuMGuqM2s2Z217BMbgU8hdDNGFTvBOzL9sMdXCw9IMSaWeh3-mald4a9rO4SJSmUJU6a2E21THYqwC18l-9j0DmwEsCQLSja7RRX3xSCa5pvdXq--JXHz6jt6GxoF570MHSBybWT8XsAE2c-elsMD4AQBkgUECAQYAZIFBAgFGASgBgKAB9yZmb0BqAeKnLECqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEO6gDtIICQiI4YAQEAEYHYAKAcgLAdgTDdAVAYAXAbIXGgoYCAASFHB1Yi0zOTkzOTIwNzg5MTc3MTM2&sigh=dGmAotVQ2Co
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 10325185295079726140
tpc.googlesyndication.com/simgad/ Frame 1F4C 19 KB
19 KB 13ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10325185295079726140?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlkHy2wwCZzhhN9bDiRqMyPsi3kYQ

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a5d4285755fd0b31ba04888752b18cc11549cd896def034a6e1e112bd240dd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 28 May 2021 04:01:31 GMT
x-content-type-options: nosniff
last-modified: Thu, 25 Mar 2021 19:17:40 GMT
server: sffe
age: 265459
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19321
x-xss-protection: 0
expires: Sat, 28 May 2022 04:01:31 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1F4C 2 KB
2 KB 10ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 14:36:54 GMT
x-content-type-options: nosniff
server: cafe
age: 54536
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 31 May 2021 14:36:54 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1F4C 295 B
319 B 8ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 22:17:05 GMT
x-content-type-options: nosniff
server: cafe
age: 26925
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 May 2021 22:17:05 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 1F4C 0
0 20ms
17ms Image
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSshr05a5zj4Kz2zBbJIiq32F1efkNMBFOI5ri2tVjTdAYzkEW7JGoTkl4CerWudkHklqUdjnpu0VWrf_6urDVAn7-VJA
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 1F4C 0
0 33ms
31ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cp4UxDXi0YOeKBoqy3gPnkK3YBtLrkINi_f7_uMgN5pLI-oAiEAEggbX5KWCRhICA-BegAYzm5sICyAECqQLa2qfgfHS0PuACAKgDAcgDCKoEoAJP0HIas8i0LpbDTRLBEBTe4WGZZh8p7Ih5rWv4m9HKuzrv8WHwK88CV9TwstHt4uEK1iJXoHNaFYi9IpeEPKVWSD4Y3c-yNlEvSx2lJW1iPKW8z9QZ4Ir3BOsw7yQr2uGg-M_EOFbfZi-xKZJEGS8pTNLQgG9_5B49udbmXX1mw3PZRDdZQvs1-v19Fmgo8MENaS3MmeTm3nNmeFx-89IYDWL0q1a6BsIIo3L4Qrq80T4iQ4NE2WkdDn658rSc6nVi0j4IpvniytPtyV4Hf0ue8BTiVk8ZOApwvqGyF8naV-AODtG6smpd51e_e9bMajYEMdpEUuxI02uFnjqU_vWjQRwAl0mdtB51bzbxzSUZ9Tdgkqkos8qEsZ7gQIxPWV7ABNnPnpbDA-AEAZIFBAgEGAGSBQQIBRgEoAYCgAfcmZm9AagHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBCavQfSCAkIiOGAEBABGB2ACgHICwHYEw3QFQGAFwGyFxoKGAgAEhRwdWItMzk5MzkyMDc4OTE3NzEzNg&sigh=FWjCRNVUggk
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8211 2 KB
2 KB 8ms
5ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 14:36:54 GMT
x-content-type-options: nosniff
server: cafe
age: 54536
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 31 May 2021 14:36:54 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8211 295 B
319 B 9ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 22:17:05 GMT
x-content-type-options: nosniff
server: cafe
age: 26925
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 May 2021 22:17:05 GMT

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 8211 0
0 33ms
32ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CsnO6DXi0YOyKBoqy3gPnkK3YBteHqsJi75ztwfcN29keEAEggbX5KWCRhICA-BegAaqTseIDyAEJqQLa2qfgfHS0PuACAKgDAcgDCKoEpAJP0HzGzXzvCcBRrU3zg0oNtBuW49BCcWj1ehv7sAY6B9PDyamzl2ELoFdtJCBwd6Ykm5ieEC2mxvQ1JLd0Il1xYQrQLXhD1p462OIa0tCH4AqLDCuVbWABkojKa4Wqh4QF1OKcsPw2glAhBq4vQjAu2ncH7fziS-tMFdksjfbOF-a5TBHaE-_VElhs0WzY7wg99gkOAJXDJXhMCXATEJgy646SL4gl5qoSwc4i0qjvVZpnM8F7E67g03g2G3NcXu4YBLzYs83DT--i6J_C7KCiizM7tZHNmyYwSB3JZ0qiE7yc2MRZxyUTHzs4ES19SHy-a87m_3I4jH3y6_PivsGJMyerObjnLsU5yOpA7jisKexL8DdEvRsdTV5fN9bvO7glgRnjwASq_cej-ALgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHvuzOHagHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBCc6BfSCAkIiOGAEBABGB2ACgHICwHYEw3QFQGAFwGyFxoKGAgAEhRwdWItMzk5MzkyMDc4OTE3NzEzNg&sigh=ncfY-kkxQFw&template_id=419
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 50af16c0b7f47b4feca3631c233bb768.jpg
tpc.googlesyndication.com/sadbundle/9517118105585293401/media/ Frame 8211 43 KB
43 KB 52ms
50ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/9517118105585293401/media/50af16c0b7f47b4feca3631c233bb768.jpg

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9128b1d7f7b52515a897d69d304f9685ed3634757cb2f8fa149dfbb54352b991

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
last-modified: Wed, 05 May 2021 13:21:26 GMT
server: sffe
x-dns-prefetch-control: off
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44054
x-xss-protection: 0
expires: Tue, 31 May 2022 05:45:50 GMT

GET
H3-29 200 f0ed4e243d16e2c045bbf05c7daa217c.png
tpc.googlesyndication.com/sadbundle/9517118105585293401/media/ Frame 8211 3 KB
3 KB 43ms
42ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/9517118105585293401/media/f0ed4e243d16e2c045bbf05c7daa217c.png

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a88a65aaa5cf0915453542b49ee678f052f32fa03e50c0f0becb66127e79540

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
last-modified: Wed, 05 May 2021 13:21:26 GMT
server: sffe
x-dns-prefetch-control: off
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3308
x-xss-protection: 0
expires: Tue, 31 May 2022 05:45:50 GMT

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/ Frame A74B 232 KB
86 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2059963059415547&plah=www.manicapost.co.zw&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d7401bef80e31a1aa3a2d1daab189dfba7f02a21e7cfef216e011f0c05a74da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87658
x-xss-protection: 0
server: cafe
etag: 5316214545020586774
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 31 May 2021 05:45:50 GMT

GET
DATA 200
OK truncated
/ Frame A74B 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f33c9161b0be10c9e14d5fa71db400bb77bef2db4271127874b4fc0b70f57a99

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame DD90 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.manicapost.co.zw
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 27 May 2021 01:32:02 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
age: 360828
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
expires: Fri, 27 May 2022 01:32:02 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame DD90 21 KB
21 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.manicapost.co.zw
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 27 May 2021 01:31:31 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
age: 360859
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
expires: Fri, 27 May 2022 01:31:31 GMT

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/ Frame E1D5 20 KB
4 KB 7ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c662d3bff7289b3288aa26686a683958747bf2e2e14b3623127da094cc70bcac

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/11829745323518310093/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Mon, 24 May 2021 10:42:53 GMT
expires: Tue, 24 May 2022 10:42:53 GMT
last-modified: Mon, 10 May 2021 06:53:36 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 3960
age: 586977
cache-control: public, max-age=31536000
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9049 0
0 31ms
31ms Fetch
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C5-DRDXi0YOmKBoqy3gPnkK3YBrn75PBesba_yIwOp9Lfhc8YEAEggbX5KWCRhICA-BegAfLbn-EDyAEJqQLa2qfgfHS0PuACAKgDAcgDCKoEnAJP0BxQnK-z6SuCUqGINBT2YeG0dM6fI2wbdK1RtES4Zw7LY3DTCVZiAO3furOH8X_P1-tpV21OFGhxocKPchk-8lb_FPoE-qXAkZ5mpWT8QDyL1V5MPGE9ZyITN2kgWAVWvEPKMPWlsorYzsbz9x9e0hPcCZOpYLJg5iGl7n3YUUgrzfMfXjrLI0bAgST01MzrU81OK602IIIoJQE6acs5AQax1J8AR3kJXKhYHK8JJk0KeP5vPY8XUWXBKdPRHTyBVU_LDq95EpE9GtJ6wYeJ2JeoUjVNBjYFCWs-OOhiqCAv9dDd-XGY3247WLP7FRtonbc-Q3tidlWQ-t3h_Nv8KlWTxxeQOqFZLP7zln4GQ0NsCfUjahOif_kpqcAEucS9h8wC4AQBkgUECAQYAZIFBAgFGASgBi6AB_aj4B6oB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwQQq5AF0ggJCIjhgBAQARgdgAoByAsB2BMN0BUBmBYBgBcBshcaChgIABIUcHViLTM5OTM5MjA3ODkxNzcxMzY&sigh=vDwTfDp3bGE&template_id=419
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/ Frame 9049 17 KB
7 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/abg_lite_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4cc755a99349527933df50f5338a02d972da947a4c25f4a5309f4545ddc40ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:35:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 642
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7025
x-xss-protection: 0
server: cafe
etag: 8821855511435206686
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:35:08 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 9049 2 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/window_focus_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:45:04 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9049 121 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e45ca14bc59eff23fa77a56b5a047910b4bb21832fb69ef9308c3e16caabbe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028738751036"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37763
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 9049 13 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

684722f2ec67f3a1b4aad3b445dd37b60d048d66701dfff1f5c40b3bad4fae8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1319581658596578636
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:44:38 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 9049 0
0 14ms
13ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSqd68HGYKk0QqKvAJqwd-VmkFwZ8l5JqQLixTpC9BLAPwueGJlk_HyIgOdHOwSlSn_aaba6tbbBxk-S0-pIupHBi_VAw
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 1F4C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

16ms
16ms

Image
text/html

2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 6F98
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

16ms
16ms

Image
text/html

2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/ Frame 3587 79 KB
19 KB 7ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/index.html

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ca751259d4d082cb1074ce854f88c4d530727eef1c78860528ffbe0acfc63f3

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/15338438512577467951/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Fri, 28 May 2021 11:54:34 GMT
expires: Sat, 28 May 2022 11:54:34 GMT
last-modified: Thu, 18 Feb 2021 11:56:47 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 19859
age: 237076
cache-control: public, max-age=31536000
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 2362 0
0 32ms
31ms Fetch
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CDaXrDXi0YOuKBoqy3gPnkK3YBtLeuOdi8PvjpfgM29keEAEggbX5KWCRhICA-BegAaGGpdQDyAEJqQLa2qfgfHS0PuACAKgDAcgDCKoEmwJP0JXw9oz7TF212Ig9xjReJctQxfDpslfsuNlDiqcPgEzOsorPgSFReVe5ELF66O1w2dEyO4gd5TO6ePgGkfW_xW5jWAN__dTLC-JKI1oxXjMwntMAqFhOmTz9zXG0nrIGdQ24v5EYHey1-t20CnfhaLCW0KyiEnyYyFKm2Sl2dgKco2_hfIZReM1YQ8NCg34kmZOP-mzXH28oLv20YzMYxVu9kFxukckxHb4GuYG0O2hHIcn_gWlrtwNQGbBIAJJc3UQ0Gf4WrXBQfbRmrzXgNALg2luvYgFpgJmS8OLM-hLIo5QNYSTjNB6OzEzPx3AxPdBoL7dTq0rhCoDq4fvksJoWjo66VtaSG6DvxvPC9TdtDv-W9_p2G8ERwATex4zArQPgBAGSBQQIBBgBkgUECAUYBKAGLoAHx_naK6gHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBDjhQ3SCAkIiOGAEBABGB2ACgHICwHYEw3QFQGYFgGAFwGyFxoKGAgAEhRwdWItMzk5MzkyMDc4OTE3NzEzNg&sigh=kD48CRO9r44&template_id=419
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/ Frame 2362 17 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/abg_lite_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4cc755a99349527933df50f5338a02d972da947a4c25f4a5309f4545ddc40ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:35:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 642
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7025
x-xss-protection: 0
server: cafe
etag: 8821855511435206686
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:35:08 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 2362 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/window_focus_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:45:04 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2362 121 KB
37 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e45ca14bc59eff23fa77a56b5a047910b4bb21832fb69ef9308c3e16caabbe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028738751036"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37763
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 2362 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

684722f2ec67f3a1b4aad3b445dd37b60d048d66701dfff1f5c40b3bad4fae8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1319581658596578636
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:44:38 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 2362 0
0 14ms
14ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSxbuA4vOrVC2fdhEJnJghEHYwtj_405m8TfZlgS87kPC23Qq_S9VCixq8l0v-4ev0CzZR8mrCApLtGuW2aRNq49VeXkg
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/ Frame 7EF0 20 KB
4 KB 8ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c662d3bff7289b3288aa26686a683958747bf2e2e14b3623127da094cc70bcac

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/11829745323518310093/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Mon, 24 May 2021 10:42:53 GMT
expires: Tue, 24 May 2022 10:42:53 GMT
last-modified: Mon, 10 May 2021 06:53:36 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 3960
age: 586977
cache-control: public, max-age=31536000
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame B4E0 0
0 34ms
32ms Fetch
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CMZ8PDXi0YOqKBoqy3gPnkK3YBrn75PBesba_yIwOp9Lfhc8YEAEggbX5KWCRhICA-BegAfLbn-EDyAEJqQLa2qfgfHS0PuACAKgDAcgDCKoEngJP0Jsm859WJ1FMB9YGRDkhrUQtzAkjqlgxBh39KXp-LOy3xxkSq66nrH_K6DPCC6ourAcfzvd5_xG6TOBlZpzaP50itt1wohhkTQ8Iugem_5OWX1pjb4OUcu9K9wiZE7QlNAMHjkDQPDvll29XAKVcs2nrpYoXaPhVd3w72jHXXIeC5aYeJFy_IqDNVi9-W_9UU6TN-1oUmdBFmEuxobpCWqMB4Kn12uIsu2Qo9BMAkYYRR6PbD_9sRLVLSY0-IjrtIJgXiRW_YTxfBvtp4ceTOwUrXphCNeMcKyh070M46kVbD_tdEfVTZW1rnw2ciUggf_UV2kG2OoBA4WvYNdf6oKvH3CAH9navaMvhybfj6rk0yeUmubuHEEaRHw0GwAS5xL2HzALgBAGSBQQIBBgBkgUECAUYBKAGLoAH9qPgHqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBCk4wbSCAkIiOGAEBABGB2ACgHICwHYEw3QFQGYFgGAFwGyFxoKGAgAEhRwdWItMzk5MzkyMDc4OTE3NzEzNg&sigh=XGzYQWpiRiw&template_id=419
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/ Frame B4E0 17 KB
7 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/abg_lite_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4cc755a99349527933df50f5338a02d972da947a4c25f4a5309f4545ddc40ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:35:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 642
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7025
x-xss-protection: 0
server: cafe
etag: 8821855511435206686
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:35:08 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame B4E0 2 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/window_focus_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:45:04 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B4E0 121 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e45ca14bc59eff23fa77a56b5a047910b4bb21832fb69ef9308c3e16caabbe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028738751036"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37763
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame B4E0 13 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

684722f2ec67f3a1b4aad3b445dd37b60d048d66701dfff1f5c40b3bad4fae8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1319581658596578636
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:44:38 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame B4E0 0
0 15ms
14ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQQXZMOgXsST_1Q8a9Z52mqLjrUZ_T49DGc4fmscHmebOBjc3JIoHEJK4Ki2nQIpVvh112pG5WwT3Yl3ZbZden183Q_Kw
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 65B0 624 B
350 B 16ms
16ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1Ku1PTAB&v=APEucNUc30iRQzrNWo0k3BjYziEphw6obZbTEhp0lf9l_NtVCvz_XPqCBQERtkB57x_Knik78cbrTZZBUCIwWRWbRYSN9sd-kMgemJmqH2cU1DfLoxT1SSR-5r17nv4GqYFSwcmeusYQWW0JvLHIl3UPiUCGjfBetvZZDm1TKe0vka3JDRKOO6I

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsY1Ku1PTAB&v=APEucNUc30iRQzrNWo0k3BjYziEphw6obZbTEhp0lf9l_NtVCvz_XPqCBQERtkB57x_Knik78cbrTZZBUCIwWRWbRYSN9sd-kMgemJmqH2cU1DfLoxT1SSR-5r17nv4GqYFSwcmeusYQWW0JvLHIl3UPiUCGjfBetvZZDm1TKe0vka3JDRKOO6I
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUne4ScALci5hlIA3IWuOesl6S2-R_epeDnNoxbhjA6Phd2Wj1LR8WKhUkBEk44
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 31 May 2021 05:45:50 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9877 24 KB
12 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DCQqUBb566GJ-x0rpqn851mKgoMehWVo20Q_KF1aVYm42n3rlh9NL1VC9oOfsjZH6EROPcoqmxuj8NOyDA7ayGklfadwbQcq6lYcIu3GQPyjt5nha8BkZ-aZd-FIJkBqlVE0hOl0KfA9x6TfWpeGkBNcv9PA&cry=1&dbm_d=AKAmf-AbZDIpp3CdWQ4maJSGPvYT6doBUZbDsajqjhzsAUzWbxnw3KigMGYW902FrDVptrDRiQxFlcKQ_DoO6wI4WXauUToGfbpKL15vorH2UYCCQ4u6hHrdDHM6f2nQmiWAdTTaVPgmXlgN3tKDELQyu13zvvRarbxIfCeH4ItqBJnSb859rZdpUrbecBWsQl78O6JqZRi0AiZWFzOmoz1w1Kl4a6lk0OfQPdKzE_4q4rJhL5RHtH9IVf61n9-fOCqZJU5j-c44Yk-oYPVj6pz3A1rmwest7umE35o0E7YG9spfkib-epIrF5mmsVOsLKP7XYIMlJuxo0fOWLGkdk0nY-4JarCXh1lrVhVWOTY7OQxOalQ5rN1S-AE6eR2g7vhpcX918_y-tXBAKgskiRLRR91q1PwZaMEqEzdzFg1Ps8QvzeCdoEFKSTG4qdjrIu5vhL_gnO9q5lDD-J9dyw5Pczrl_F1AGD2Zd8XIZABAryfD7R9IRaBgJJ3sRIsA1l0C-TKc4g6dqfn32y10RK6TvnTkXvwKjW_Gdo0bwybfa2LwKpnZ9Drx_-5j1l4cVLQtR8ubMi8eZHeybstHKqRd0LaKMOlMYd8-O4GUKQG-Lkqfy5zF9PZe7FEJZbA9XOYbLnWs_uiyklUv6aZw8OaeN4m2c2ACfQISKmqH3JP0WgBzxJHOfBSKTaKml7befgR9ERtlcP9DF248jWQGKe9TeY0H8GeRci2a9wxmjU98R0VIUHFBYC0MIXg2R5nyO5dyy4sn0nc24BjjgfwWfeX4T9Jce1djcqf9CjTPvLhMReD2ELElhKw087_QJnlsPHb1Rnjjh3t7nzKvXdWH2ICmnOFLj97ioTSSBXpM_-nmR2mD9oMonmuC0ci-99VHUqmA-Y0BEjWwJTY2l6JVRpPwck3XFnkcbU1gAxfRkVfONI_zp2AhHSyTsUBdtL23BZLb9eCOcNhD4Ff6lm5QR-bGfdwtHLwY2ApSru2dJJ4mFTRw5DdNdyC7gx4nzNfgHaWB3PY9p-RbunMGvfufstijzGpHt8FJGDq-1s2M3uVfRaUphZfD0gIBIeDIf4yjgQUer3Grvq_fN2a5gPZSUFL2v0zwJwNCkkUaOe0G9_RgVK0aJUOfY1MkhvxnJR13xhD69WCKZpSL9JIsRkjglIASD4cU0fVA9mkap3mjaVx4XU0x9aWZ0KXC7ESbp97sS7mj7KgJRTD5oluePOE_3ICkZlSE40G1RaB2rotzPNQ78sXCPmRBw4FPwEfTETvLctUMOBM9sj1Shi5KZV0w7ZlcOwmsRCTZ2OafS45T6cPNX3B0wdu5K7fciPgcOsSU9JYuT_ZskzCfrPLa03BehK8RoFVIk5U-paQM087tRZAFkKLxyLc1dqSjHqzMrUvZ3NexO8IcuzydqdMYnOe_8vz1KtHCSpAesDjyfDY8gr8QKcnuycAIZGjSFtbQN7eM9MK1_C8eaWcqrALf50ECX7-0VcM2_dZWS_ijpMbuai2m4Qt6nJWKiMO9TNy1UtooaV9rvrhHfLUocIIPkgA1e1D-0Tz2tBwVBbqLYyWM5CSk9Sjw_o3W3jkG_tPOADGcr6YwjYgz0G8ozNm1QrvtS1B1FU_b45XG9pB1TzsqjOhESPQKl6ZEMt_3QHXGILyTqwLirzniZSL7ZMRpg6K4jcN3dJB8_7ZyWpJ1gsqjvS2VgfUJFEcYeqc2m2dPRha2QsQWN4KwsRCPulP6uc20lxj3W9O6HTaJA70xcMXS29J6MaBHX9XgkB7lT1VLs6NPusMNxgnJhJnnFCeQJdnb74Q9Z33K52iQnwu3utCe2fW2_NooHtoyz7_qSyphLkXwyTdN9r8hnLfSUBMeHupj69-DlNSmPDyTdv2L-LGqbgzHy6MN1EwCAPrDg69KScmOqTJ2bstqzb1z534Eo_-A2uLQcTCpmLl0LMm8eAOXCoXSiyzsTyq_5svfEouYG11JX0C3raTLJNCQzGnGl_MxPYflqhpvrpLXV9vGd8enkA3Hg7GdzijRyqOuIQtaSjR_IRYLpvv1V06jAmVS2KYMbi0LDD7sgfbbHyEtRiB-GIePbEQCn9RPPS89j51sFB0bMZoSedbCParyYxibk8uP3z0az2NpXH1IDVRIFfmRJVHW4Az5d11EfuMeMxLOZpKEprrF6JAHAPPeUSXURWgusuejE1pjuZFvbEWDft2hTSoD-No-PLCpWHyGiOwXBg2Vb2gFeOoHn97jU88_IsH67aUaDm2Dj-5-Qab1vObmUOMSqqgwX7RRXyBhigcPCTxdzTwmnFTK5hqgJ5YDrmcYOLMMjhKIV8R9ZpNexSgjiHAosndBNsePgK8sY_57mi5ys0uqZMbePYZd3G_76f9fe8heeFqiGwBO8wo231cgcMLwbC1MOwqQU60EYUj2_puuF7Oq37qbpN2vLlFM8laILXlo3tuNHpkqYH421JBvmoZjjA5powIwutQmmWTdard6IoeUd8SDqh2bU5lPtZDwZ7aIKqX-GuAntzrQs0yh8kN3xXDD-q_I-5YXhdu7hoB5s2PcWUmzawCp5S6dOpZc171U0Ub3Cojw-LzXRTqPDh2KpoOhlZdTDaNpm6JyujV7K8hfSIaqJh8mJReAPDIkupApWR5NjOhDBRcKGDViMg8X_CxyC_5bgc3vFHq00OK5oGFDjg6nG_HT94kYCn685uITBnlsosKjMRGDtvAOmUcMC7ykan9O3VakYqz13A-MfNOrNvJ-RL0uNEpWe8z5KafMl7YmK-vjuXqBYFnL2Mvl7i9NCYYxfqmOP2GTibp04agoYSkxMhgexChQPWuuZwyJjn5Yeqprq-IjfbFGIGQRh7xYTmgGTc6aoiqWYHnQpwYTSmJQo32bJjUzYLfSHXfKOaer3qmusigEyqw7a3dml0_eJkfqVeQXDsyVqZfhyy8vKMEKEXkBoW7xo48ZH-vbM_eKbBjAb3FNP3ObwdBgODgpMOix1ufwUCX1aUm1DouhZXTNPCgmpDS9KJj0S6H8Y_CPh37Iumi74xz7em_CYmzD-ga_RkgFyX_wP6vatZLMiUbaPuVwgMu8H1IzpxGOWFIB_azCTPZnltVm2esqpgtJB1ntmBGkhr3HIhryWe6K5Zl5Es6TdNNRJzk8y3vVYV_n9HS2awsGCHeHJspZPKyIcOBhCu5XeAW2IHzfWgn9Ri8sVoBtx8BsGTFWhIKzsCZSzZgJA8C9vRzGWZLv6zFlDz1lmjA&cid=CAASFeRoU-TCyfFq2ZGik4BA8xSDkvL8TA&rfl=1%2Chttps%253A%252F%252Fwww.manicapost.co.zw%252F%240

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4e75415b3b5788ade9494857346087b15db3f7cd27f0c404267a5b3b8630a001

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12134
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9877 42 B
63 B 39ms
38ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DP-ILNxrNQf0Ens5LjZDkTeKAGx-Omonmd6ZMbRtkbIcfEGNIRNMTIVtZHEtOfoJznkxbrcF6qalepk4uRw0Py8bDJfVK8rImvftgt5GEEOEBrnj0

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 9877 2 KB
1 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/window_focus_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:45:04 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9877 121 KB
37 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e45ca14bc59eff23fa77a56b5a047910b4bb21832fb69ef9308c3e16caabbe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028738751036"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37763
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 9877 13 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

684722f2ec67f3a1b4aad3b445dd37b60d048d66701dfff1f5c40b3bad4fae8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1319581658596578636
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:44:38 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 9877 0
0 15ms
15ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTomwM-NsKgtE6cZikiwbTPCNeFv6i9CyftNwTPZbwq-HbVvOXqSSoYmW_VIZVX2IjefWhiONC98_WFe3iIffT0RWdVyw
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 91D8 640 B
363 B 22ms
14ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYntXZlQEwAQ&v=APEucNWURRadUb_DLPYWG9yskoRc1xbjFre5gIVvBBgtJjTcgwOYygF-M1VV-IkRH-6xuhV7N9trUovceEECtKn-cdX4Hyqk5NbmAOFN-lGMsIar0iDy82_UksL8w_EcVLq00tKV6g_DXh6nc0SwB4cV9ZsmfCOfS9XjvS4dqedgdXsaBIdukp0

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYntXZlQEwAQ&v=APEucNWURRadUb_DLPYWG9yskoRc1xbjFre5gIVvBBgtJjTcgwOYygF-M1VV-IkRH-6xuhV7N9trUovceEECtKn-cdX4Hyqk5NbmAOFN-lGMsIar0iDy82_UksL8w_EcVLq00tKV6g_DXh6nc0SwB4cV9ZsmfCOfS9XjvS4dqedgdXsaBIdukp0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUne4ScALci5hlIA3IWuOesl6S2-R_epeDnNoxbhjA6Phd2Wj1LR8WKhUkBEk44
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 31 May 2021 05:45:50 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 670F 24 KB
12 KB 40ms
33ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CFD3EEfsuuC4rTFfBGNvYsUsZr_assK2uAb0F_DhM72Usb0ZYsHXtGuiFcGqfbhrgL7l0ouwnKI1l9NbnkrPsi8pLfFy_1Y7fSrZuCQhx6S7l348nOLCh7VZusgtNttrM0mHmDS49gKqGRlRW0XQT1-0XL3A&cry=1&dbm_d=AKAmf-A8LEzlmgWA_JdztTZksgNkpjIUTmAgB7zutdM3pyhPNpEThIzPV8XQHXyoIyn5j4xlatJ6VjZCqoNZ6-7K5nykCgEo8jAton1jQwVYGUAeaNjhZ1f0evbAwliJdzv-8cZM3PSsbBjOe3DrF5yBeVYVwiaBm4BdQy8mHrOIaUdx3oJqXWBLS8iI123ohoiFF7V_1Ckk34wLpEYv-kDuq8lywPxKS-DVo4klJIvcNcom25thXUIlrdH5H7O9uaY-KbCO6fDqE5vfk7ygR9DZk4j2hSsN5FSA1VxDacX8rY6V-QBXcGddNjTw0CG0YAUfil6kN_k6Opj2H0oIKLsCBdRae7nun288wHo1R-fZXToO3kgrUsU8ViTs_HqrBnZcs1dNCIPP8GjFDnnJcCI4LCBwBR_1A_Z3ayA2FQujgmnknpnJd3AbshRoLC6h19o_d9nn4cYKR3o9wQrUpY5xQ1Rd3yJBRi3G2wFMepQvEbC6h5VuTKfnoj2M0NqWl0BB7TFxtnPEyVxoDUmPxsB6am3vgV1MYNk9RqeJIR5jDPATcpjpld2NU6qu3uWwjtroa7MplCCni8UPEEMi1Jsh6zUt8r2949hVp2ELcMYICWhB6rif-P90Uaixres2WCB9Ilrz1YbQwOw0mMdQTi-OoWUTsaphMNar14K6EYmQxz-iz-y_zJnIMe5XbbPrP-MVgQiKDGtOKr1g_mGhKf7jFttsbO74ojh3tp9KCc2wlfOUByTjm69N7O5ac05wJ_U6Eoi2moP22v04X2v4Ui3AZtcxsZDs7ECFSnxhY3aORqdKo9qcyjv6k9-BuX6r9ImQdPWKriX7FsEIp1f7Wfudy7M6pL6Rxt3aSQ4aeP7TpqhkEOAFnyhxcZkhvB1U6_HcTxTESPwk4vuZLOerzkI8XwQfMtSMrnAROxSq_q4Pgydb_VrgMUbd79y6-5LTDPKA1jnRY0mywblZu3gEVX_NMOMsBQV8wEjBoMeNNI8xCHiJPsK-PWVm4eYfYF5hgopyQWFJipr8IXR6LSop5Wytyba9o1xSR2UTAzYCe2HQjRrsyqaQ-WKCkgLXc1vHqS5FvmO_8C4ercmsW6Kui1PaNG8sofgB2wBVv9s5GYUcf1a8rUS8B9lYuBAiiRvgmKe2nALBXzsgyJv7wtkdivbrPIK8ZOYTp7tx2hqd1YANKsUx3Eo6nLz8KAfARUHwdLFpi-126DrJkckdB7Gg7RqMF8XCjPQGWFP3a-WLNRnylkT_lhnNlenO3tqpxU4CJelU6GPVfaM7kNYfXM2TCrafr-wLjUu05vAt0zKyIrpf4f5Cg50wuEqc7XVTMba1nrnvguBvqwh_HxCsiSKoIhVq3-4qGiepHfVdHdlOWB5IsDO3s9POc7WLcgkIGArGMrIzyuHo-O6nxITATn4a_Q86UXVN8fpalyKKoZs1UNWknO-87oBRmQdDSZTEDZBNop89xIe8SYKQy7F1ZYEbOdoWovnjSOCOmP5-Z42sODCcX3FyFpsyEM2k1ETyJ3QRaf-htEMjMcWAv60Xfpb1p4EkjVlZRd6zxJgMGIUqf5u2eSO5ds35l0ZZ_fnzG66dkX3E9PfTMnMZtnBWP98gSL9MidN7USh1WK6LIeB2Ew7PGLEaM6l6R-L-u3Ozxp3uK2HgQctjuIRYH_jqMqQj2HI2H3Y2Jgq1_0N1mXjgZs4LerBQKpX2pRlfYztIhRZoyoSrJTdscaBEzBC6JA3wJdwBDhQRonh-LxBW4_snOwXz9VXBOdwwwWhUxgkVYLECMTrZ6GMHeDwuKxwplNnBcUpqNem3_EY6tM-SPFw53rK9h7BI7z1dbGNMa9fja_O9_wrfCvSxZYMQRVQGDPs8xMJxgwsW0l54r4o-9jnS-P0bSscc4Q1I3BxwK5aCSHX4B9-FqqrWYISCA_uVObatOgxz_hG72dnBUNezvUIANojAzEbwZ-IYNNZ6ovBUuuoE1pcH5bmqGc336G6SL45BEvS8kl460bzV4TnMAKzdd141M_rEn2Deu1wGXKgaNia_BXAUceRUGnu1-roHKX__Ll4-P4qSYi7dYzffDFhL5KJlC57Bx6affCAQcTyNbNCSY7QsMim0uu8ktKugY32480gYK54BBlAx3ZUBj6z8LWmVuBiyJGgLlwmFePhJDpihuqa2JUfprhZsBlCcvSNNubNMHOjGUw5xAEw2WqpkGyLsmkZhs1APi7Jjx7l6CIHIce4uLd9bvGwu8gpntyJCbq7uErYmqjJNreBl60DdDKWpGa9qy6foSqUsTl0b2m5Kcx6HLoj8nkzga_iR912piLRACVrQ5cqutfJh5GtPcjyDRRRmgT0GyqfPAfi_hepponxC483vT_GX4xkCkHkocElgJlJdaW6iKp-EEQmL1qT_cA_WefOE53Bjx5kTD-iNIujcigGc1_Jo2eTbtZSGd52coAAtuxs2KSLSeauORaOnK8O5B9oxECUM-BNXxAb38TeK7NhyqtBrKvOs5k_2iv4VLhwnoEOWKjacZfGgcOS-fnvjjJfHOtT8BbqOPv97SwqH5SAYr0l05ILhOqlQu5O0GJ0dDHOpaklbvViWD1IrroHjkn3Tde3ZtuBjVnSh1tuSK0BcMcGH1uvEOYjRuLqFVme1a78I5CuMTxuNb3rI7rsADXktvxVIPeIRiolcNMhsG8TFDIRW2-Wu_c7g81buG7FNlA6YtzHokHF3wxj_YmEwtDw0444TcOsGvOyge9oKtQsr8iO1_HMmhQTuL74ajrod0jkRkAlyTLpM3nnjh9MMIUCzTDdshl0iWGnz-dllRWSTAj6Op4qorvWfBEUWNvEKrfYCaD_UbdyFne4lSkzhysxhn-8f2B6CHzoBegNwsSFle6QIdBjs7WGgtwIBSXB0FyPs1T8PUAwkciva7XqdbUwjpcD4HfXGqyQtX_0SxGiPU9mzT0AFHIsiktEHSJF9EowO-I5MV3SYdMXn--kxDONd-u3PX1dtFP_-5VOII_7seGNT6wT4evz_ErxaDMcDa-_Zg3QT2xb-k3pUZmNk7hsBFd-v8j44n5qezbg-asx_rrketfg1J0cyH6jPyMmxwU9-enY1mtwMoE1WcAii56azxt6cZ4sxyo-PQbiVUw3YVrEyJzNuMIJnFfe7eh8bf2LcnTzSQ7EX2hqYtb53YWClRsRn5_4umHJZzYaK-S3qkNU1llvRbXZUWLCt7gz-ApNzwyb_6rNkEyHKqcxN-EEYXA8&cid=CAASFeRoj0YP9TWA234Q8egzIX4xsf6WrQ&rfl=1%2Chttps%253A%252F%252Fwww.manicapost.co.zw%252F%240

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

002017ec0f0edde493c861948f440284209eedb37dc0933bf85f4c16d96f55fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12149
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 670F 42 B
63 B 47ms
40ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ARSZQgIAlvmnt1d1sxoEc2nxDEFIJjCVb2I7Jl0dGsfsrOUJvJyx0a4bkS1E-rXYDWBTd7RyvWGoqTYyCpNT-29FTBjisYr01ip8l5Rn2DdmiFz4Y

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 670F 2 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/window_focus_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:45:04 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 670F 121 KB
37 KB 18ms
14ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e45ca14bc59eff23fa77a56b5a047910b4bb21832fb69ef9308c3e16caabbe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028738751036"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37763
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 670F 13 KB
6 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

684722f2ec67f3a1b4aad3b445dd37b60d048d66701dfff1f5c40b3bad4fae8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1319581658596578636
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:44:38 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 670F 0
0 21ms
14ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQgjXO1bdpBtzCJqJ34T4kXKLcK80pdke3bpTjXJ2xSO00LehLz4dI_vPLZAvw10oXSQoZwYiEb8U_OReRuKgalTvtozg
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0540 499 B
381 B 23ms
17ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1Ku1PTAB&v=APEucNWj-v1LkEd3xbqzOwFyIXp8GJ6fWnxhsE-TIaq8I2RuZA5cV4Wz5_fQUBpOooCIVA_6291marC_EN3kCnmgmy967G-H_pIcnjHIrE-8O916hFo8kws40pQgJe8WXdMInAWFTCGsWmFiEa4dOiZ5OStqPeFaU3UEmbbV0SPW6Z_LBHKv5UM

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

583eda12fed77c078f7391866e53eedd80aec5b9b178a3537a3c4c3b09575485

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsY1Ku1PTAB&v=APEucNWj-v1LkEd3xbqzOwFyIXp8GJ6fWnxhsE-TIaq8I2RuZA5cV4Wz5_fQUBpOooCIVA_6291marC_EN3kCnmgmy967G-H_pIcnjHIrE-8O916hFo8kws40pQgJe8WXdMInAWFTCGsWmFiEa4dOiZ5OStqPeFaU3UEmbbV0SPW6Z_LBHKv5UM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUne4ScALci5hlIA3IWuOesl6S2-R_epeDnNoxbhjA6Phd2Wj1LR8WKhUkBEk44
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 31 May 2021 05:45:50 GMT
server: cafe
cache-control: private
content-length: 313
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9B19 24 KB
12 KB 38ms
31ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cp4Zze149hZ1Z5GBqFElcj_-sBwl6RpwAY_Mdg4efBIBEk6_DXAkUegAHjYzIN3dRiK4Ep-nqGLwTLAYPmje7sK_rRCR6KEhLblo7AwCvLkqa4hzNNrSQnJN0V5YTer0V3XV0_-owSDJTm--XVTvX1xiv65w&cry=1&dbm_d=AKAmf-DE8rrM5mtByCooaWaL-Rtu7ouGJgb3WJK7vUhAZra0tB-9wDI6qZRk5DkpSYEt0isZsj5azHcvZ8tim7oLmReU4MochvTVvnG-yhUlCAlpOPa-juxJnwKRC1JauzGiXM-zXq_p77PJMGhrcCYa6HAP3xcMBL0UULUKuC6uv6FML9M58pgFrxNuSYz3NJV8MKOPs5CbVBU3U0SnxSRCHHvwBafy0p-fQt18gyMkAcc3CO9F1fW96-C0ZCvv-PLpoCwrcwSfzuhlCiKTAU0t805ak_6-fvhvv81QyMs1smAmiQR_-HC5YurQnX5i4g74iImreU8RLgylhvA9O32asBhjm9eIdJQVKUc_3aTWnisp_mX5M0meJOS5r23rcEncUKbwYS76xNb3L4cB8bzonW6mR0hJLuwGTlsrESrd-zXYvZ7wG024qnqxo91IHz2rbJ5pEVoBdSXsNf166kvSqEgY55as2ZOdvxgFw0euU8Ew8CjkV5rb-k-VOIZ6pMVJz11d-Ltzpvz2i4Ob6YkrzsPUdQkr9ScSyVtJ9eYz2H8td6bT24Q-v_-5XF3On5xreZKBJOogaVtgs42spobFWNQ4uXSHEY_w-oaSHZOaahGuZZNUNOj0ZOrcAnGXBGqfQleyNLgMim9e7OD0ovwJKFkNzVMpX7YWHqKCC53Tk1WZ80In8oybz4FG9808Z8gW0T-5y7eBfUxSMUqxSaFjy7jHLbo4QmtqtajVpc2er37wdu5lbQHkgYna-J7spR17h6SRlo0RgOZbxDuDiWr56bnjSUKqfjp7AUU7Gervx7ZD0P4qNjWqpufp3quUTKCXVuPmUkxEVzm6hNSlIQ23IShQptaayXLjvapnb0glDy6Dg2q1aZjeu_rWGKb2v17pw3VNZw_Ga2vWw3yz2BEYE_rrGhgiLFirTHArfDu-Oql83xnGqIkT1zmncF5VPD94J7hS-GsIKMXf9SHFE01P8CGw6jzhbx380Ntbv6JyjbACNNsOc1YFeIznXIjFUQxemKsBST45P5KHBOOccKrxqVzp15EvImM4gD1x9mhEgMUS1ylb0QogwysJNBXECtOaahk-X9gPXsiMJmrq78mwBe1aqKQ02bn6EwxB-HZfWgRmw11aLQFXNOGQg5oQcvUU6to1giuIPiQvwztC2-qodFoVz7lURVwJOyvGPIBjjpTE5W2ErAMLLasfvzlsZ8Th4rJT39McWQyC1oXqGUkHLnR73h3rX4qTK_9uVFL6vgOn89KbXphXCZU1rAXxrxQjxV_A3p3fyxWak4uxrDxZPymVeWpWgTWSS-5vfkWRKBFe6N2VdytkR83s2jSig-Lcolx-yu2okc3YvFrPmnO857im99MQAZHun-SvGJTxnyVq6TF0yHM3nTk8E1-AUe8Jk2N2us5hQlbjKhN2lQU7NsCAs_L2l_wA6lUWPpz69GOzj_XLolP1Jv24UAzHR-1l3SmsPBVSwnsh3LJFe56hEq8kqR142y-u3guvgkA9DYzxBPxXF5hximz9XC7WjxTunVCAkNfLcyPzDJTEXa29QD4kq9cvXrPNzutmJVEnWgXtQRJUZKXKMPxzqb587x6Z45tHf2buHleaqJaiOJlWG8oxlaZxY8dFhthM727ur4WuvWjalYeLZ8GrIIjfRj0vq03G81jBdXWzaVRbvgCygfJDR9-O-7Gj6lAJ0QflG9lz9spi9BJrQvg061i-Y8q3ctPG4NgERxDqLv1uAdzYV6JnrrsemxrDw-sgTzhVReIXUlqxiXE2bdrhvuHFGjtmiBYKkiKtqICvVsFT9hKKrIwSayc2nAqWixN_YSSVJW_jIvfrSmqdafUakqTBhPSepSZm5D1b-n0JzTRBm288jeG-ZyipuUiZNNx6TrzUZuYQ563_AfNeYf-vJ_E4A4KNe86hDQDANE7gXg0EOGyDrMInlfVvP9YLGxiPEh5inNRzXqTzirQvq1clsmybOHtwPbn15GPi8NtMXo-SXYYSuYpEe4f4jBpMbUCI-RRDkQku-PXouKGeUkbrrjHJdbq63-Tb_OBZmZE7zglomsxoBB81rpMAyeS8nd-N33zc7AY0MJFuzDfW31klPK_d9EHmaNcLEoKpx5K4nZS0dk-o9J0mwrWu3F5KBYsECUcYHlKIkDptWiZnOJG54gfgrCufz8gX3c42IdtHqau7q_OajY3vFevo8viVb9IjyaTsaGr65BsgYVVQSNhjP4x_B3oNkNuQNsSO-adAazgV4EF3v481lM4wBMuTSqA4lbr5p3roe3tfz6Iq7672ueHeVlQ0JPiJJTPyM7RSJRvyp72JnzdWw4ZYQQzYkDozUGrXXI5Ux59tktjZBCddf8KdUAmJDIlviQG8K235KzU6FPbz_MIp5ljSb4Evg2Rpw5reoA1OyzAWMfXnTY2aSt0l6XWY0L7k4K6JHbSBcDOzAIoiX1o7j0-aJmL9o9o_iM3bhEy58cb6Pf_dlsTfU5xq7zXtBDXkZdUOZO9b4IiJG8d7Eujp8jcBgjCqYu-2um-XWEnVTEsTbRuxSInhQMKoetMugyewFovuWZFMfnZ--jBmeEilZoNTJ_fBDpEZeDhO-V6RtZKKsJEc0s9ew9zuNaFzbCPVTv-DmAO2_SUw3mLEp0Axt1s-rNksmhK2pkLTay1jBRk1xPWlAFSC6S4FsxFyX9kN30YXLGoMjCScU-ZBs--PGeaN-ftNNxlT6X9svL8vG1SaVZdNh8gDw6cqubpTsrZGppNhQF0WAr3MI0lrmA1CQjuUW4fzrEe4-UBmkSyDhQcH1ktf-_vBHa0gNEgwFztFPIRes0oAmwf-BzTgoQnsxuXUgfCiPlOYZu9WuZ92Lg6bKBSRDLXuLe6lexmzZU5LvN9pq2zHc3-QHXre-eZEu_lMb7AQr3f4rgzzFnW6g_cn9mWMNRFTkzmy2dQm_zWj7MTIJR0y1Mf2SHw_t142bt_7278BWMFYkBwPdOEKwZBgMbbuGZ7CxFkBpyfXP563MiNwfbL0McLi1n51Y4LEWNBQY4REUDBmwGYp2vXPnkcEZ1JsCHU_rhZIOewAIOGm7_bfoI6k5GaNkj3VK4TCh9UOlBXhE75780GQJdrD9HYmn68QNv80HZTSyPSwsgXq5X_NUH2mxoECbEZ40cXZkDJAd7RSEpruQt8xWIIlWD5CffBJArULgnnVx-_U6Vll7zwHLjb0LHDdZSSLX7XYTXBGuk8trTVlHCUdGCQJs6cF7Mw&cid=CAASFeRoG0XgkhdZ0QiMU6uU2yIlJ07PmQ&rfl=1%2Chttps%253A%252F%252Fwww.manicapost.co.zw%252F%240

Requested by

Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de847f008cefaa0af3f0dc06ff01fac03477faa591c75c9f1f8ddac42b23d8b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12142
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9B19 42 B
63 B 45ms
39ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AKYMK3hDz7SxRHDWczfbBkry_Xp4T_1JheCYB7h-uYaPKHV1FtxCm5ScT1NGyEnIO7wcdZoXA98ejrEPaSnJsvxD9z8x92ZgFZ-eFCRU5uUAMXVQE

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 9B19 2 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/window_focus_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:45:04 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9B19 121 KB
37 KB 16ms
13ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e45ca14bc59eff23fa77a56b5a047910b4bb21832fb69ef9308c3e16caabbe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028738751036"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37763
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/ Frame 9B19 13 KB
6 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210524/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

684722f2ec67f3a1b4aad3b445dd37b60d048d66701dfff1f5c40b3bad4fae8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1319581658596578636
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:44:38 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 9B19 0
0 18ms
13ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSHyN7mQdsN5uALdPZdGyZFX5ic6QmcHv7j_WTNIWyuw1lhYz0Rk_zcPK1XHa_lDnHq_r2KQslV5WPwN9_rmjkjn7tBUg
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame A74B 12 B
100 B 29ms
29ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.manicapost.co.zw&callback=_gfp_s_&client=ca-pub-2059963059415547&cookie=ID%3Db5952aeb8a19fa04-2296b2ee58c800fe%3AT%3D1622439948%3AS%3DALNI_MYctW0KfM2oGCk-eStVn648JdKTGg

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2059963059415547&plah=www.manicapost.co.zw&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame A74B 107 B
165 B 18ms
15ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.manicapost.co.zw

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2059963059415547&plah=www.manicapost.co.zw&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame A74B 107 B
165 B 17ms
14ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.manicapost.co.zw

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2059963059415547&plah=www.manicapost.co.zw&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 400 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 82F2 603 B
66 B 25ms
24ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2059963059415547&output=html&h=100&slotname=Zimpaper_320x100&adk=2950050393&adf=816031645&pi=t.ma~as.Zimpaper_320x100&w=320&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439950332&bpp=7&bdt=222&idt=194&shv=r20210524&cbv=%2Fr20190131&ptt=5&saldr=sa&cookie=ID%3Db5952aeb8a19fa04-2296b2ee58c800fe%3AT%3D1622439948%3AS%3DALNI_MYctW0KfM2oGCk-eStVn648JdKTGg&correlator=1441014396034&frm=23&ife=4&pv=2&ga_vid=866574880.1622439951&ga_sid=1622439951&ga_hid=592487814&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=986&ady=307&biw=1600&bih=1200&isw=320&ish=100&ifk=3847667090&scr_x=0&scr_y=0&eid=42530672&oid=3&pvsid=606131567089719&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C320%2C100&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.qedgoscj8vih&fsb=1&dtd=210

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2059963059415547&plah=www.manicapost.co.zw&amaexp=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2059963059415547&output=html&h=100&slotname=Zimpaper_320x100&adk=2950050393&adf=816031645&pi=t.ma~as.Zimpaper_320x100&w=320&url=https%3A%2F%2Fwww.manicapost.co.zw%2F&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622439950332&bpp=7&bdt=222&idt=194&shv=r20210524&cbv=%2Fr20190131&ptt=5&saldr=sa&cookie=ID%3Db5952aeb8a19fa04-2296b2ee58c800fe%3AT%3D1622439948%3AS%3DALNI_MYctW0KfM2oGCk-eStVn648JdKTGg&correlator=1441014396034&frm=23&ife=4&pv=2&ga_vid=866574880.1622439951&ga_sid=1622439951&ga_hid=592487814&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=986&ady=307&biw=1600&bih=1200&isw=320&ish=100&ifk=3847667090&scr_x=0&scr_y=0&eid=42530672&oid=3&pvsid=606131567089719&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C320%2C100&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.qedgoscj8vih&fsb=1&dtd=210
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUne4ScALci5hlIA3IWuOesl6S2-R_epeDnNoxbhjA6Phd2Wj1LR8WKhUkBEk44
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 31 May 2021 05:45:50 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame A74B 73 KB
27 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2059963059415547&plah=www.manicapost.co.zw&amaexp=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f359cea41f7e97a585f44c7c318c4f2314b2981060da1623e39d8d348ff9150

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622028727180027"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27990
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame DD90 2 KB
2 KB 7ms
5ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 14:36:54 GMT
x-content-type-options: nosniff
server: cafe
age: 54536
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 31 May 2021 14:36:54 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame DD90 295 B
319 B 8ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 22:17:05 GMT
x-content-type-options: nosniff
server: cafe
age: 26925
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 May 2021 22:17:05 GMT

GET
H3-29 200 4585298385342408497
tpc.googlesyndication.com/simgad/ Frame 6F98 40 KB
40 KB 9ms
8ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4585298385342408497?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qm4i3QpCDomOObqCQp7n8IN5r_rrA

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cde74d28de3cfa3e76df590e6d952450621bf0934cd7ceaa4501404680fc61f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 28 May 2021 04:44:13 GMT
x-content-type-options: nosniff
last-modified: Thu, 25 Mar 2021 19:17:31 GMT
server: sffe
age: 262897
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40698
x-xss-protection: 0
expires: Sat, 28 May 2022 04:44:13 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6F98 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 14:36:54 GMT
x-content-type-options: nosniff
server: cafe
age: 54536
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 31 May 2021 14:36:54 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6F98 295 B
319 B 8ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 22:17:05 GMT
x-content-type-options: nosniff
server: cafe
age: 26925
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 May 2021 22:17:05 GMT

GET
H3-29 200 10325185295079726140
tpc.googlesyndication.com/simgad/ Frame 1F4C 19 KB
19 KB 12ms
10ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10325185295079726140?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlkHy2wwCZzhhN9bDiRqMyPsi3kYQ

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a5d4285755fd0b31ba04888752b18cc11549cd896def034a6e1e112bd240dd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 28 May 2021 04:01:31 GMT
x-content-type-options: nosniff
last-modified: Thu, 25 Mar 2021 19:17:40 GMT
server: sffe
age: 265459
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19321
x-xss-protection: 0
expires: Sat, 28 May 2022 04:01:31 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1F4C 2 KB
2 KB 10ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 14:36:54 GMT
x-content-type-options: nosniff
server: cafe
age: 54536
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 31 May 2021 14:36:54 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1F4C 295 B
319 B 10ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 22:17:05 GMT
x-content-type-options: nosniff
server: cafe
age: 26925
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 May 2021 22:17:05 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8211 2 KB
2 KB 10ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 14:36:54 GMT
x-content-type-options: nosniff
server: cafe
age: 54536
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 31 May 2021 14:36:54 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8211 295 B
319 B 10ms
10ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 22:17:05 GMT
x-content-type-options: nosniff
server: cafe
age: 26925
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 May 2021 22:17:05 GMT

GET
H3-29 200 50af16c0b7f47b4feca3631c233bb768.jpg
tpc.googlesyndication.com/sadbundle/9517118105585293401/media/ Frame 8211 43 KB
43 KB 11ms
10ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/9517118105585293401/media/50af16c0b7f47b4feca3631c233bb768.jpg

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9128b1d7f7b52515a897d69d304f9685ed3634757cb2f8fa149dfbb54352b991

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44054
x-xss-protection: 0
last-modified: Wed, 05 May 2021 13:21:26 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 May 2022 05:45:50 GMT

GET
H3-29 200 f0ed4e243d16e2c045bbf05c7daa217c.png
tpc.googlesyndication.com/sadbundle/9517118105585293401/media/ Frame 8211 3 KB
3 KB 11ms
10ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/9517118105585293401/media/f0ed4e243d16e2c045bbf05c7daa217c.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a88a65aaa5cf0915453542b49ee678f052f32fa03e50c0f0becb66127e79540

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3308
x-xss-protection: 0
last-modified: Wed, 05 May 2021 13:21:26 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 May 2022 05:45:50 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210524/r20110914/ Frame 9877 22 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210524/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DCQqUBb566GJ-x0rpqn851mKgoMehWVo20Q_KF1aVYm42n3rlh9NL1VC9oOfsjZH6EROPcoqmxuj8NOyDA7ayGklfadwbQcq6lYcIu3GQPyjt5nha8BkZ-aZd-FIJkBqlVE0hOl0KfA9x6TfWpeGkBNcv9PA&cry=1&dbm_d=AKAmf-AbZDIpp3CdWQ4maJSGPvYT6doBUZbDsajqjhzsAUzWbxnw3KigMGYW902FrDVptrDRiQxFlcKQ_DoO6wI4WXauUToGfbpKL15vorH2UYCCQ4u6hHrdDHM6f2nQmiWAdTTaVPgmXlgN3tKDELQyu13zvvRarbxIfCeH4ItqBJnSb859rZdpUrbecBWsQl78O6JqZRi0AiZWFzOmoz1w1Kl4a6lk0OfQPdKzE_4q4rJhL5RHtH9IVf61n9-fOCqZJU5j-c44Yk-oYPVj6pz3A1rmwest7umE35o0E7YG9spfkib-epIrF5mmsVOsLKP7XYIMlJuxo0fOWLGkdk0nY-4JarCXh1lrVhVWOTY7OQxOalQ5rN1S-AE6eR2g7vhpcX918_y-tXBAKgskiRLRR91q1PwZaMEqEzdzFg1Ps8QvzeCdoEFKSTG4qdjrIu5vhL_gnO9q5lDD-J9dyw5Pczrl_F1AGD2Zd8XIZABAryfD7R9IRaBgJJ3sRIsA1l0C-TKc4g6dqfn32y10RK6TvnTkXvwKjW_Gdo0bwybfa2LwKpnZ9Drx_-5j1l4cVLQtR8ubMi8eZHeybstHKqRd0LaKMOlMYd8-O4GUKQG-Lkqfy5zF9PZe7FEJZbA9XOYbLnWs_uiyklUv6aZw8OaeN4m2c2ACfQISKmqH3JP0WgBzxJHOfBSKTaKml7befgR9ERtlcP9DF248jWQGKe9TeY0H8GeRci2a9wxmjU98R0VIUHFBYC0MIXg2R5nyO5dyy4sn0nc24BjjgfwWfeX4T9Jce1djcqf9CjTPvLhMReD2ELElhKw087_QJnlsPHb1Rnjjh3t7nzKvXdWH2ICmnOFLj97ioTSSBXpM_-nmR2mD9oMonmuC0ci-99VHUqmA-Y0BEjWwJTY2l6JVRpPwck3XFnkcbU1gAxfRkVfONI_zp2AhHSyTsUBdtL23BZLb9eCOcNhD4Ff6lm5QR-bGfdwtHLwY2ApSru2dJJ4mFTRw5DdNdyC7gx4nzNfgHaWB3PY9p-RbunMGvfufstijzGpHt8FJGDq-1s2M3uVfRaUphZfD0gIBIeDIf4yjgQUer3Grvq_fN2a5gPZSUFL2v0zwJwNCkkUaOe0G9_RgVK0aJUOfY1MkhvxnJR13xhD69WCKZpSL9JIsRkjglIASD4cU0fVA9mkap3mjaVx4XU0x9aWZ0KXC7ESbp97sS7mj7KgJRTD5oluePOE_3ICkZlSE40G1RaB2rotzPNQ78sXCPmRBw4FPwEfTETvLctUMOBM9sj1Shi5KZV0w7ZlcOwmsRCTZ2OafS45T6cPNX3B0wdu5K7fciPgcOsSU9JYuT_ZskzCfrPLa03BehK8RoFVIk5U-paQM087tRZAFkKLxyLc1dqSjHqzMrUvZ3NexO8IcuzydqdMYnOe_8vz1KtHCSpAesDjyfDY8gr8QKcnuycAIZGjSFtbQN7eM9MK1_C8eaWcqrALf50ECX7-0VcM2_dZWS_ijpMbuai2m4Qt6nJWKiMO9TNy1UtooaV9rvrhHfLUocIIPkgA1e1D-0Tz2tBwVBbqLYyWM5CSk9Sjw_o3W3jkG_tPOADGcr6YwjYgz0G8ozNm1QrvtS1B1FU_b45XG9pB1TzsqjOhESPQKl6ZEMt_3QHXGILyTqwLirzniZSL7ZMRpg6K4jcN3dJB8_7ZyWpJ1gsqjvS2VgfUJFEcYeqc2m2dPRha2QsQWN4KwsRCPulP6uc20lxj3W9O6HTaJA70xcMXS29J6MaBHX9XgkB7lT1VLs6NPusMNxgnJhJnnFCeQJdnb74Q9Z33K52iQnwu3utCe2fW2_NooHtoyz7_qSyphLkXwyTdN9r8hnLfSUBMeHupj69-DlNSmPDyTdv2L-LGqbgzHy6MN1EwCAPrDg69KScmOqTJ2bstqzb1z534Eo_-A2uLQcTCpmLl0LMm8eAOXCoXSiyzsTyq_5svfEouYG11JX0C3raTLJNCQzGnGl_MxPYflqhpvrpLXV9vGd8enkA3Hg7GdzijRyqOuIQtaSjR_IRYLpvv1V06jAmVS2KYMbi0LDD7sgfbbHyEtRiB-GIePbEQCn9RPPS89j51sFB0bMZoSedbCParyYxibk8uP3z0az2NpXH1IDVRIFfmRJVHW4Az5d11EfuMeMxLOZpKEprrF6JAHAPPeUSXURWgusuejE1pjuZFvbEWDft2hTSoD-No-PLCpWHyGiOwXBg2Vb2gFeOoHn97jU88_IsH67aUaDm2Dj-5-Qab1vObmUOMSqqgwX7RRXyBhigcPCTxdzTwmnFTK5hqgJ5YDrmcYOLMMjhKIV8R9ZpNexSgjiHAosndBNsePgK8sY_57mi5ys0uqZMbePYZd3G_76f9fe8heeFqiGwBO8wo231cgcMLwbC1MOwqQU60EYUj2_puuF7Oq37qbpN2vLlFM8laILXlo3tuNHpkqYH421JBvmoZjjA5powIwutQmmWTdard6IoeUd8SDqh2bU5lPtZDwZ7aIKqX-GuAntzrQs0yh8kN3xXDD-q_I-5YXhdu7hoB5s2PcWUmzawCp5S6dOpZc171U0Ub3Cojw-LzXRTqPDh2KpoOhlZdTDaNpm6JyujV7K8hfSIaqJh8mJReAPDIkupApWR5NjOhDBRcKGDViMg8X_CxyC_5bgc3vFHq00OK5oGFDjg6nG_HT94kYCn685uITBnlsosKjMRGDtvAOmUcMC7ykan9O3VakYqz13A-MfNOrNvJ-RL0uNEpWe8z5KafMl7YmK-vjuXqBYFnL2Mvl7i9NCYYxfqmOP2GTibp04agoYSkxMhgexChQPWuuZwyJjn5Yeqprq-IjfbFGIGQRh7xYTmgGTc6aoiqWYHnQpwYTSmJQo32bJjUzYLfSHXfKOaer3qmusigEyqw7a3dml0_eJkfqVeQXDsyVqZfhyy8vKMEKEXkBoW7xo48ZH-vbM_eKbBjAb3FNP3ObwdBgODgpMOix1ufwUCX1aUm1DouhZXTNPCgmpDS9KJj0S6H8Y_CPh37Iumi74xz7em_CYmzD-ga_RkgFyX_wP6vatZLMiUbaPuVwgMu8H1IzpxGOWFIB_azCTPZnltVm2esqpgtJB1ntmBGkhr3HIhryWe6K5Zl5Es6TdNNRJzk8y3vVYV_n9HS2awsGCHeHJspZPKyIcOBhCu5XeAW2IHzfWgn9Ri8sVoBtx8BsGTFWhIKzsCZSzZgJA8C9vRzGWZLv6zFlDz1lmjA&cid=CAASFeRoU-TCyfFq2ZGik4BA8xSDkvL8TA&rfl=1%2Chttps%253A%252F%252Fwww.manicapost.co.zw%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e515f6e09f5e26caff10460e9a027e236ec78caffaa756799730b20f4d33320

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:42:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 205
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8609
x-xss-protection: 0
server: cafe
etag: 7365582700020686358
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:42:25 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9877 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 16:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49512
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 30 May 2022 16:00:38 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210524/r20110914/ Frame 670F 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210524/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CFD3EEfsuuC4rTFfBGNvYsUsZr_assK2uAb0F_DhM72Usb0ZYsHXtGuiFcGqfbhrgL7l0ouwnKI1l9NbnkrPsi8pLfFy_1Y7fSrZuCQhx6S7l348nOLCh7VZusgtNttrM0mHmDS49gKqGRlRW0XQT1-0XL3A&cry=1&dbm_d=AKAmf-A8LEzlmgWA_JdztTZksgNkpjIUTmAgB7zutdM3pyhPNpEThIzPV8XQHXyoIyn5j4xlatJ6VjZCqoNZ6-7K5nykCgEo8jAton1jQwVYGUAeaNjhZ1f0evbAwliJdzv-8cZM3PSsbBjOe3DrF5yBeVYVwiaBm4BdQy8mHrOIaUdx3oJqXWBLS8iI123ohoiFF7V_1Ckk34wLpEYv-kDuq8lywPxKS-DVo4klJIvcNcom25thXUIlrdH5H7O9uaY-KbCO6fDqE5vfk7ygR9DZk4j2hSsN5FSA1VxDacX8rY6V-QBXcGddNjTw0CG0YAUfil6kN_k6Opj2H0oIKLsCBdRae7nun288wHo1R-fZXToO3kgrUsU8ViTs_HqrBnZcs1dNCIPP8GjFDnnJcCI4LCBwBR_1A_Z3ayA2FQujgmnknpnJd3AbshRoLC6h19o_d9nn4cYKR3o9wQrUpY5xQ1Rd3yJBRi3G2wFMepQvEbC6h5VuTKfnoj2M0NqWl0BB7TFxtnPEyVxoDUmPxsB6am3vgV1MYNk9RqeJIR5jDPATcpjpld2NU6qu3uWwjtroa7MplCCni8UPEEMi1Jsh6zUt8r2949hVp2ELcMYICWhB6rif-P90Uaixres2WCB9Ilrz1YbQwOw0mMdQTi-OoWUTsaphMNar14K6EYmQxz-iz-y_zJnIMe5XbbPrP-MVgQiKDGtOKr1g_mGhKf7jFttsbO74ojh3tp9KCc2wlfOUByTjm69N7O5ac05wJ_U6Eoi2moP22v04X2v4Ui3AZtcxsZDs7ECFSnxhY3aORqdKo9qcyjv6k9-BuX6r9ImQdPWKriX7FsEIp1f7Wfudy7M6pL6Rxt3aSQ4aeP7TpqhkEOAFnyhxcZkhvB1U6_HcTxTESPwk4vuZLOerzkI8XwQfMtSMrnAROxSq_q4Pgydb_VrgMUbd79y6-5LTDPKA1jnRY0mywblZu3gEVX_NMOMsBQV8wEjBoMeNNI8xCHiJPsK-PWVm4eYfYF5hgopyQWFJipr8IXR6LSop5Wytyba9o1xSR2UTAzYCe2HQjRrsyqaQ-WKCkgLXc1vHqS5FvmO_8C4ercmsW6Kui1PaNG8sofgB2wBVv9s5GYUcf1a8rUS8B9lYuBAiiRvgmKe2nALBXzsgyJv7wtkdivbrPIK8ZOYTp7tx2hqd1YANKsUx3Eo6nLz8KAfARUHwdLFpi-126DrJkckdB7Gg7RqMF8XCjPQGWFP3a-WLNRnylkT_lhnNlenO3tqpxU4CJelU6GPVfaM7kNYfXM2TCrafr-wLjUu05vAt0zKyIrpf4f5Cg50wuEqc7XVTMba1nrnvguBvqwh_HxCsiSKoIhVq3-4qGiepHfVdHdlOWB5IsDO3s9POc7WLcgkIGArGMrIzyuHo-O6nxITATn4a_Q86UXVN8fpalyKKoZs1UNWknO-87oBRmQdDSZTEDZBNop89xIe8SYKQy7F1ZYEbOdoWovnjSOCOmP5-Z42sODCcX3FyFpsyEM2k1ETyJ3QRaf-htEMjMcWAv60Xfpb1p4EkjVlZRd6zxJgMGIUqf5u2eSO5ds35l0ZZ_fnzG66dkX3E9PfTMnMZtnBWP98gSL9MidN7USh1WK6LIeB2Ew7PGLEaM6l6R-L-u3Ozxp3uK2HgQctjuIRYH_jqMqQj2HI2H3Y2Jgq1_0N1mXjgZs4LerBQKpX2pRlfYztIhRZoyoSrJTdscaBEzBC6JA3wJdwBDhQRonh-LxBW4_snOwXz9VXBOdwwwWhUxgkVYLECMTrZ6GMHeDwuKxwplNnBcUpqNem3_EY6tM-SPFw53rK9h7BI7z1dbGNMa9fja_O9_wrfCvSxZYMQRVQGDPs8xMJxgwsW0l54r4o-9jnS-P0bSscc4Q1I3BxwK5aCSHX4B9-FqqrWYISCA_uVObatOgxz_hG72dnBUNezvUIANojAzEbwZ-IYNNZ6ovBUuuoE1pcH5bmqGc336G6SL45BEvS8kl460bzV4TnMAKzdd141M_rEn2Deu1wGXKgaNia_BXAUceRUGnu1-roHKX__Ll4-P4qSYi7dYzffDFhL5KJlC57Bx6affCAQcTyNbNCSY7QsMim0uu8ktKugY32480gYK54BBlAx3ZUBj6z8LWmVuBiyJGgLlwmFePhJDpihuqa2JUfprhZsBlCcvSNNubNMHOjGUw5xAEw2WqpkGyLsmkZhs1APi7Jjx7l6CIHIce4uLd9bvGwu8gpntyJCbq7uErYmqjJNreBl60DdDKWpGa9qy6foSqUsTl0b2m5Kcx6HLoj8nkzga_iR912piLRACVrQ5cqutfJh5GtPcjyDRRRmgT0GyqfPAfi_hepponxC483vT_GX4xkCkHkocElgJlJdaW6iKp-EEQmL1qT_cA_WefOE53Bjx5kTD-iNIujcigGc1_Jo2eTbtZSGd52coAAtuxs2KSLSeauORaOnK8O5B9oxECUM-BNXxAb38TeK7NhyqtBrKvOs5k_2iv4VLhwnoEOWKjacZfGgcOS-fnvjjJfHOtT8BbqOPv97SwqH5SAYr0l05ILhOqlQu5O0GJ0dDHOpaklbvViWD1IrroHjkn3Tde3ZtuBjVnSh1tuSK0BcMcGH1uvEOYjRuLqFVme1a78I5CuMTxuNb3rI7rsADXktvxVIPeIRiolcNMhsG8TFDIRW2-Wu_c7g81buG7FNlA6YtzHokHF3wxj_YmEwtDw0444TcOsGvOyge9oKtQsr8iO1_HMmhQTuL74ajrod0jkRkAlyTLpM3nnjh9MMIUCzTDdshl0iWGnz-dllRWSTAj6Op4qorvWfBEUWNvEKrfYCaD_UbdyFne4lSkzhysxhn-8f2B6CHzoBegNwsSFle6QIdBjs7WGgtwIBSXB0FyPs1T8PUAwkciva7XqdbUwjpcD4HfXGqyQtX_0SxGiPU9mzT0AFHIsiktEHSJF9EowO-I5MV3SYdMXn--kxDONd-u3PX1dtFP_-5VOII_7seGNT6wT4evz_ErxaDMcDa-_Zg3QT2xb-k3pUZmNk7hsBFd-v8j44n5qezbg-asx_rrketfg1J0cyH6jPyMmxwU9-enY1mtwMoE1WcAii56azxt6cZ4sxyo-PQbiVUw3YVrEyJzNuMIJnFfe7eh8bf2LcnTzSQ7EX2hqYtb53YWClRsRn5_4umHJZzYaK-S3qkNU1llvRbXZUWLCt7gz-ApNzwyb_6rNkEyHKqcxN-EEYXA8&cid=CAASFeRoj0YP9TWA234Q8egzIX4xsf6WrQ&rfl=1%2Chttps%253A%252F%252Fwww.manicapost.co.zw%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e515f6e09f5e26caff10460e9a027e236ec78caffaa756799730b20f4d33320

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:42:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 205
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8609
x-xss-protection: 0
server: cafe
etag: 7365582700020686358
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:42:25 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 670F 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 16:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49512
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 30 May 2022 16:00:38 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210524/r20110914/ Frame 9B19 22 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210524/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cp4Zze149hZ1Z5GBqFElcj_-sBwl6RpwAY_Mdg4efBIBEk6_DXAkUegAHjYzIN3dRiK4Ep-nqGLwTLAYPmje7sK_rRCR6KEhLblo7AwCvLkqa4hzNNrSQnJN0V5YTer0V3XV0_-owSDJTm--XVTvX1xiv65w&cry=1&dbm_d=AKAmf-DE8rrM5mtByCooaWaL-Rtu7ouGJgb3WJK7vUhAZra0tB-9wDI6qZRk5DkpSYEt0isZsj5azHcvZ8tim7oLmReU4MochvTVvnG-yhUlCAlpOPa-juxJnwKRC1JauzGiXM-zXq_p77PJMGhrcCYa6HAP3xcMBL0UULUKuC6uv6FML9M58pgFrxNuSYz3NJV8MKOPs5CbVBU3U0SnxSRCHHvwBafy0p-fQt18gyMkAcc3CO9F1fW96-C0ZCvv-PLpoCwrcwSfzuhlCiKTAU0t805ak_6-fvhvv81QyMs1smAmiQR_-HC5YurQnX5i4g74iImreU8RLgylhvA9O32asBhjm9eIdJQVKUc_3aTWnisp_mX5M0meJOS5r23rcEncUKbwYS76xNb3L4cB8bzonW6mR0hJLuwGTlsrESrd-zXYvZ7wG024qnqxo91IHz2rbJ5pEVoBdSXsNf166kvSqEgY55as2ZOdvxgFw0euU8Ew8CjkV5rb-k-VOIZ6pMVJz11d-Ltzpvz2i4Ob6YkrzsPUdQkr9ScSyVtJ9eYz2H8td6bT24Q-v_-5XF3On5xreZKBJOogaVtgs42spobFWNQ4uXSHEY_w-oaSHZOaahGuZZNUNOj0ZOrcAnGXBGqfQleyNLgMim9e7OD0ovwJKFkNzVMpX7YWHqKCC53Tk1WZ80In8oybz4FG9808Z8gW0T-5y7eBfUxSMUqxSaFjy7jHLbo4QmtqtajVpc2er37wdu5lbQHkgYna-J7spR17h6SRlo0RgOZbxDuDiWr56bnjSUKqfjp7AUU7Gervx7ZD0P4qNjWqpufp3quUTKCXVuPmUkxEVzm6hNSlIQ23IShQptaayXLjvapnb0glDy6Dg2q1aZjeu_rWGKb2v17pw3VNZw_Ga2vWw3yz2BEYE_rrGhgiLFirTHArfDu-Oql83xnGqIkT1zmncF5VPD94J7hS-GsIKMXf9SHFE01P8CGw6jzhbx380Ntbv6JyjbACNNsOc1YFeIznXIjFUQxemKsBST45P5KHBOOccKrxqVzp15EvImM4gD1x9mhEgMUS1ylb0QogwysJNBXECtOaahk-X9gPXsiMJmrq78mwBe1aqKQ02bn6EwxB-HZfWgRmw11aLQFXNOGQg5oQcvUU6to1giuIPiQvwztC2-qodFoVz7lURVwJOyvGPIBjjpTE5W2ErAMLLasfvzlsZ8Th4rJT39McWQyC1oXqGUkHLnR73h3rX4qTK_9uVFL6vgOn89KbXphXCZU1rAXxrxQjxV_A3p3fyxWak4uxrDxZPymVeWpWgTWSS-5vfkWRKBFe6N2VdytkR83s2jSig-Lcolx-yu2okc3YvFrPmnO857im99MQAZHun-SvGJTxnyVq6TF0yHM3nTk8E1-AUe8Jk2N2us5hQlbjKhN2lQU7NsCAs_L2l_wA6lUWPpz69GOzj_XLolP1Jv24UAzHR-1l3SmsPBVSwnsh3LJFe56hEq8kqR142y-u3guvgkA9DYzxBPxXF5hximz9XC7WjxTunVCAkNfLcyPzDJTEXa29QD4kq9cvXrPNzutmJVEnWgXtQRJUZKXKMPxzqb587x6Z45tHf2buHleaqJaiOJlWG8oxlaZxY8dFhthM727ur4WuvWjalYeLZ8GrIIjfRj0vq03G81jBdXWzaVRbvgCygfJDR9-O-7Gj6lAJ0QflG9lz9spi9BJrQvg061i-Y8q3ctPG4NgERxDqLv1uAdzYV6JnrrsemxrDw-sgTzhVReIXUlqxiXE2bdrhvuHFGjtmiBYKkiKtqICvVsFT9hKKrIwSayc2nAqWixN_YSSVJW_jIvfrSmqdafUakqTBhPSepSZm5D1b-n0JzTRBm288jeG-ZyipuUiZNNx6TrzUZuYQ563_AfNeYf-vJ_E4A4KNe86hDQDANE7gXg0EOGyDrMInlfVvP9YLGxiPEh5inNRzXqTzirQvq1clsmybOHtwPbn15GPi8NtMXo-SXYYSuYpEe4f4jBpMbUCI-RRDkQku-PXouKGeUkbrrjHJdbq63-Tb_OBZmZE7zglomsxoBB81rpMAyeS8nd-N33zc7AY0MJFuzDfW31klPK_d9EHmaNcLEoKpx5K4nZS0dk-o9J0mwrWu3F5KBYsECUcYHlKIkDptWiZnOJG54gfgrCufz8gX3c42IdtHqau7q_OajY3vFevo8viVb9IjyaTsaGr65BsgYVVQSNhjP4x_B3oNkNuQNsSO-adAazgV4EF3v481lM4wBMuTSqA4lbr5p3roe3tfz6Iq7672ueHeVlQ0JPiJJTPyM7RSJRvyp72JnzdWw4ZYQQzYkDozUGrXXI5Ux59tktjZBCddf8KdUAmJDIlviQG8K235KzU6FPbz_MIp5ljSb4Evg2Rpw5reoA1OyzAWMfXnTY2aSt0l6XWY0L7k4K6JHbSBcDOzAIoiX1o7j0-aJmL9o9o_iM3bhEy58cb6Pf_dlsTfU5xq7zXtBDXkZdUOZO9b4IiJG8d7Eujp8jcBgjCqYu-2um-XWEnVTEsTbRuxSInhQMKoetMugyewFovuWZFMfnZ--jBmeEilZoNTJ_fBDpEZeDhO-V6RtZKKsJEc0s9ew9zuNaFzbCPVTv-DmAO2_SUw3mLEp0Axt1s-rNksmhK2pkLTay1jBRk1xPWlAFSC6S4FsxFyX9kN30YXLGoMjCScU-ZBs--PGeaN-ftNNxlT6X9svL8vG1SaVZdNh8gDw6cqubpTsrZGppNhQF0WAr3MI0lrmA1CQjuUW4fzrEe4-UBmkSyDhQcH1ktf-_vBHa0gNEgwFztFPIRes0oAmwf-BzTgoQnsxuXUgfCiPlOYZu9WuZ92Lg6bKBSRDLXuLe6lexmzZU5LvN9pq2zHc3-QHXre-eZEu_lMb7AQr3f4rgzzFnW6g_cn9mWMNRFTkzmy2dQm_zWj7MTIJR0y1Mf2SHw_t142bt_7278BWMFYkBwPdOEKwZBgMbbuGZ7CxFkBpyfXP563MiNwfbL0McLi1n51Y4LEWNBQY4REUDBmwGYp2vXPnkcEZ1JsCHU_rhZIOewAIOGm7_bfoI6k5GaNkj3VK4TCh9UOlBXhE75780GQJdrD9HYmn68QNv80HZTSyPSwsgXq5X_NUH2mxoECbEZ40cXZkDJAd7RSEpruQt8xWIIlWD5CffBJArULgnnVx-_U6Vll7zwHLjb0LHDdZSSLX7XYTXBGuk8trTVlHCUdGCQJs6cF7Mw&cid=CAASFeRoG0XgkhdZ0QiMU6uU2yIlJ07PmQ&rfl=1%2Chttps%253A%252F%252Fwww.manicapost.co.zw%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e515f6e09f5e26caff10460e9a027e236ec78caffaa756799730b20f4d33320

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:42:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 205
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8609
x-xss-protection: 0
server: cafe
etag: 7365582700020686358
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 14 Jun 2021 05:42:25 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9B19 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 16:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49512
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 30 May 2022 16:00:38 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F6EB 143 B
163 B 9ms
6ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUne4ScALci5hlIA3IWuOesl6S2-R_epeDnNoxbhjA6Phd2Wj1LR8WKhUkBEk44; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 31 May 2021 05:29:22 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 988
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 9049 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c42b6e05139583e046ae36bb3c4a5468b5bd28da2de146f2c7df9ae82babf3d5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame E1D5 9 KB
3 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 03:57:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6529
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 01 Jun 2021 03:57:01 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame E1D5 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 18:54:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39070
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 31 May 2021 18:54:40 GMT

GET
H3-29 200 8c3a7777bbd8e2b1a877158e6eab1276.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/ Frame E1D5 65 KB
17 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c56448b45d965391ebec4b7c6c4230650932dad5ae7acbcb321060c1a374360c

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17084
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D8F5 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUne4ScALci5hlIA3IWuOesl6S2-R_epeDnNoxbhjA6Phd2Wj1LR8WKhUkBEk44; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 31 May 2021 05:29:22 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 988
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 2362 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ea94dab6f27afe7dd90d627ab632ad9f924ada429d50aaa9ee1b1e0cd7909c65

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 css
fonts.googleapis.com/ Frame 3587 4 KB
618 B 27ms
25ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,regular

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f7bba0cc484923e9dc8eb46a451efbd2ebe40980e07195777adaa39956bc5cd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 31 May 2021 04:38:13 GMT
server: ESF
date: Mon, 31 May 2021 05:45:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H3-29 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 3587 16 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 03:56:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6537
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5866
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 01 Jun 2021 03:56:53 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 3587 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 18:54:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39070
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 31 May 2021 18:54:40 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9937 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUne4ScALci5hlIA3IWuOesl6S2-R_epeDnNoxbhjA6Phd2Wj1LR8WKhUkBEk44; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 31 May 2021 05:29:22 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 988
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame B4E0 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e380b0d6dd9d28f1749c454601fcf8c23c91f381b027b9a98719ceb964d85ce

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 7EF0 9 KB
3 KB 12ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 03:57:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6529
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 01 Jun 2021 03:57:01 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 7EF0 26 KB
10 KB 11ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 18:54:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39070
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 31 May 2021 18:54:40 GMT

GET
H3-29 200 8c3a7777bbd8e2b1a877158e6eab1276.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/ Frame 7EF0 65 KB
17 KB 12ms
7ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c56448b45d965391ebec4b7c6c4230650932dad5ae7acbcb321060c1a374360c

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17084
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 65B0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHgvLN1DAj7GohL4jtORceQ&google_cver=1

43 B
1014 B

892ms
848ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHgvLN1DAj7GohL4jtORceQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1Ku1PTAB&v=APEucNUc30iRQzrNWo0k3BjYziEphw6obZbTEhp0lf9l_NtVCvz_XPqCBQERtkB57x_Knik78cbrTZZBUCIwWRWbRYSN9sd-kMgemJmqH2cU1DfLoxT1SSR-5r17nv4GqYFSwcmeusYQWW0JvLHIl3UPiUCGjfBetvZZDm1TKe0vka3JDRKOO6I
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 31 May 2021 05:45:51 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 31 May 2021 05:45:51 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHgvLN1DAj7GohL4jtORceQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 65B0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YLR4Dk..DxI3DHA9g1UW9wAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHgvLN1DAj7GohL4jtORceQ&google_cver=1&google_hm=2

43 B
1014 B

37ms
37ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHgvLN1DAj7GohL4jtORceQ&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1Ku1PTAB&v=APEucNUc30iRQzrNWo0k3BjYziEphw6obZbTEhp0lf9l_NtVCvz_XPqCBQERtkB57x_Knik78cbrTZZBUCIwWRWbRYSN9sd-kMgemJmqH2cU1DfLoxT1SSR-5r17nv4GqYFSwcmeusYQWW0JvLHIl3UPiUCGjfBetvZZDm1TKe0vka3JDRKOO6I
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 31 May 2021 05:45:51 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 31 May 2021 05:45:51 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHgvLN1DAj7GohL4jtORceQ&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 65B0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEKFZx6sVAQzDPEdx5mwzdUU&google_cver=1

43 B
1019 B

26ms
15ms

Image
image/gif

185.33.220.243
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEKFZx6sVAQzDPEdx5mwzdUU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1Ku1PTAB&v=APEucNUc30iRQzrNWo0k3BjYziEphw6obZbTEhp0lf9l_NtVCvz_XPqCBQERtkB57x_Knik78cbrTZZBUCIwWRWbRYSN9sd-kMgemJmqH2cU1DfLoxT1SSR-5r17nv4GqYFSwcmeusYQWW0JvLHIl3UPiUCGjfBetvZZDm1TKe0vka3JDRKOO6I

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.243 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 31 May 2021 05:45:50 GMT
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.137:80
AN-X-Request-Uuid: 864020df-eb77-4ec9-be7c-5833d75e3ec1
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEKFZx6sVAQzDPEdx5mwzdUU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 65B0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzAyOTA3Mjk5OTc5MDgyMTI5OQ%3D%3D

170 B
188 B

41ms
40ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzAyOTA3Mjk5OTc5MDgyMTI5OQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 31 May 2021 05:45:50 GMT
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.221.48:80
AN-X-Request-Uuid: c2fdfdc1-7f46-47cd-855e-b7db34c14aee
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzAyOTA3Mjk5OTc5MDgyMTI5OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 91D8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOmNv-2F1zeQ1NIx6yAhFVk&google_cver=1

43 B
172 B

22ms
22ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOmNv-2F1zeQ1NIx6yAhFVk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYntXZlQEwAQ&v=APEucNWURRadUb_DLPYWG9yskoRc1xbjFre5gIVvBBgtJjTcgwOYygF-M1VV-IkRH-6xuhV7N9trUovceEECtKn-cdX4Hyqk5NbmAOFN-lGMsIar0iDy82_UksL8w_EcVLq00tKV6g_DXh6nc0SwB4cV9ZsmfCOfS9XjvS4dqedgdXsaBIdukp0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.207.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
via: 1.1 google
server: OXGW/16.207.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOmNv-2F1zeQ1NIx6yAhFVk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 91D8
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWEzMGIzMTItMWQ0OC0yN2Q2LWQzYmYtODJmZTJjYzRiNDM4

170 B
188 B

32ms
31ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWEzMGIzMTItMWQ0OC0yN2Q2LWQzYmYtODJmZTJjYzRiNDM4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYntXZlQEwAQ&v=APEucNWURRadUb_DLPYWG9yskoRc1xbjFre5gIVvBBgtJjTcgwOYygF-M1VV-IkRH-6xuhV7N9trUovceEECtKn-cdX4Hyqk5NbmAOFN-lGMsIar0iDy82_UksL8w_EcVLq00tKV6g_DXh6nc0SwB4cV9ZsmfCOfS9XjvS4dqedgdXsaBIdukp0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
server: OXGW/16.207.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWEzMGIzMTItMWQ0OC0yN2Q2LWQzYmYtODJmZTJjYzRiNDM4
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 91D8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEE6bfX-y1-Nch_h3prRpj9g&google_cver=1

23 B
172 B

51ms
51ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEE6bfX-y1-Nch_h3prRpj9g&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYntXZlQEwAQ&v=APEucNWURRadUb_DLPYWG9yskoRc1xbjFre5gIVvBBgtJjTcgwOYygF-M1VV-IkRH-6xuhV7N9trUovceEECtKn-cdX4Hyqk5NbmAOFN-lGMsIar0iDy82_UksL8w_EcVLq00tKV6g_DXh6nc0SwB4cV9ZsmfCOfS9XjvS4dqedgdXsaBIdukp0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 31 May 2021 05:45:50 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEE6bfX-y1-Nch_h3prRpj9g&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 91D8
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MTY4ZWMxYzk1YTY1NDRhMzI1OGZkYmJlMTc2NWMwNjVkNTdlZTc3Yg==

170 B
188 B

31ms
31ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MTY4ZWMxYzk1YTY1NDRhMzI1OGZkYmJlMTc2NWMwNjVkNTdlZTc3Yg==

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
server: akka-http/10.2.3
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MTY4ZWMxYzk1YTY1NDRhMzI1OGZkYmJlMTc2NWMwNjVkNTdlZTc3Yg==
cache-control: max-age=0, no-cache, no-store
content-length: 197
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 0540
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDhx_R225u2GfW65wF0Z35A&google_cver=1

43 B
548 B

40ms
18ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDhx_R225u2GfW65wF0Z35A&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1Ku1PTAB&v=APEucNWj-v1LkEd3xbqzOwFyIXp8GJ6fWnxhsE-TIaq8I2RuZA5cV4Wz5_fQUBpOooCIVA_6291marC_EN3kCnmgmy967G-H_pIcnjHIrE-8O916hFo8kws40pQgJe8WXdMInAWFTCGsWmFiEa4dOiZ5OStqPeFaU3UEmbbV0SPW6Z_LBHKv5UM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.180.125 , United States, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:50 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 92
Connection: keep-alive
Content-Length: 43

Redirect headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDhx_R225u2GfW65wF0Z35A&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 306
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0540
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NzRlODVkZmQtYzFkMy0xMWViLTg3MjgtMTJiMWNlMzIwMTA2

170 B
188 B

32ms
31ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NzRlODVkZmQtYzFkMy0xMWViLTg3MjgtMTJiMWNlMzIwMTA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1Ku1PTAB&v=APEucNWj-v1LkEd3xbqzOwFyIXp8GJ6fWnxhsE-TIaq8I2RuZA5cV4Wz5_fQUBpOooCIVA_6291marC_EN3kCnmgmy967G-H_pIcnjHIrE-8O916hFo8kws40pQgJe8WXdMInAWFTCGsWmFiEa4dOiZ5OStqPeFaU3UEmbbV0SPW6Z_LBHKv5UM

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 31 May 2021 05:45:50 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NzRlODVkZmQtYzFkMy0xMWViLTg3MjgtMTJiMWNlMzIwMTA2
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 144
Connection: keep-alive
Content-Length: 0

GET
H2 204 v1
ads.yahoo.com/cms/ Frame 0540 0
445 B 22ms
7ms Image
text/plain 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~b04e41039133c73fafd60e0ed8cb49a70ecfb061&nwid=10000483131&sigv=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3E98 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Sun, 30 May 2021 16:00:38 GMT
expires: Mon, 30 May 2022 16:00:38 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 49512
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 8d7ecc08eab94b960bcaef5ffc03514d.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 9 KB
9 KB 13ms
11ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/8d7ecc08eab94b960bcaef5ffc03514d.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

559887ee3ed9c6647e83bca9be99f2a8fc4586d11457dd96231259a5c09d5eb2

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9000
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 be864b9889d0607eafaaf0a5ccfe41e9.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 4 KB
4 KB 13ms
11ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/be864b9889d0607eafaaf0a5ccfe41e9.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d563ab5c6b46551718ad9ee5ef1ae828c64c2f9c7fb697f19fc7526566c9890a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4307
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 8c9879862fc691cac4c7a802216abd26.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 5 KB
5 KB 12ms
10ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/8c9879862fc691cac4c7a802216abd26.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

062fc1ec27743765f8fe8ea17b7aa2f5c4cb440bb15c2c6cc4b384a140a34bee

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 138140
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4971
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Sat, 29 May 2021 15:23:30 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 15:23:30 GMT

GET
H3-29 200 1818b7b853f9ab8ab089dee30d8be270.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 5 KB
5 KB 17ms
15ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/1818b7b853f9ab8ab089dee30d8be270.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c71387ab708c1c8e4f7d83aff28378dc95f6864d6c99a9118ce32d16ee4865a4

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5150
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 919645c043ab2a9a53ffd64501754e9f.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 19 KB
19 KB 16ms
14ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/919645c043ab2a9a53ffd64501754e9f.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16ba4d835e9b44c688b2a7b7ae400bab62db6eb945f836bd7ff3a20df39cb4ff

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19484
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 9ba0e05d7a3768d4770c96c6719681e3.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 3 KB
1 KB 16ms
14ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/9ba0e05d7a3768d4770c96c6719681e3.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11204abca2bebfba977f8d457cb0aa9a207167cebdb878f6177f26ef9cbc239f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1166
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 2f9ac4478d65aafc09386aa93c251ab7.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 2 KB
2 KB 15ms
13ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/2f9ac4478d65aafc09386aa93c251ab7.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e3e5c9da4ee2b652cd6cb34229147697def38f5cb79b9533b4a45daaef88af25

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1854
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 8a94c402746079cacd04f962f53034d6.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 410 B
319 B 14ms
13ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/8a94c402746079cacd04f962f53034d6.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

178f3d1421cd3d41c37445c258992b6299cb88f732c08ba2524ed06332c9f61f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 286
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 4d94673d5b278b12eabea83f4b4b3ae1.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 2 KB
803 B 14ms
12ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/4d94673d5b278b12eabea83f4b4b3ae1.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d336cb925fcfdf4ba8d70c944d8b5ccfe30515f456ae06f58044cd5bfe261838

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 770
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 95bf90d1ef70a64031fa0c69455bbf9d.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 2 KB
2 KB 13ms
11ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/95bf90d1ef70a64031fa0c69455bbf9d.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

431109939c869edef966caefbc34cb613c3236c74bcd80b3caf5e2d46607bf09

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2341
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4027 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Sun, 30 May 2021 16:00:38 GMT
expires: Mon, 30 May 2022 16:00:38 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 49512
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3EBB 22 KB
8 KB 6ms
5ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Sun, 30 May 2021 16:00:38 GMT
expires: Mon, 30 May 2022 16:00:38 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 49512
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 3587 15 KB
15 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,regular

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 28 May 2021 10:13:28 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
age: 243142
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
expires: Sat, 28 May 2022 10:13:28 GMT

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 3587 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,regular

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 21:15:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 549030
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
expires: Tue, 24 May 2022 21:15:20 GMT

GET
H3-29 200 view
securepubads.g.doubleclick.net/pcs/ Frame A74B 0
0 60ms
32ms Fetch
image/gif 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu4xug-r5MLw_Nvy2lQ4gmimoq72SBkT-RVfL8a-8veTEkFD7XFEQ38_Z6TAfDe7Tj-MIbZndhZHCmCDdeRUtnQfejktlhxsbjOdSd7y8vhgnRtxx2jMyunJqW7T9RQlbf-ydyuT--WMaI3lEfcj7Ga4zNqfQi4S0XnmIQxTTetVQpVlNGmapFmBF38UGmJBvVsDsFIzFycGSNBHJ_OOL88wwLN-axJzJsqVc_O1HIddDqJ4QaSkOOUE5rcUKdhChV9v7_BmV0Qe7iZk2fIqIbcbP2ZE4cAOG-QgNXuiYuAgLT7hT56DQTn6-2SxQ&sai=AMfl-YRcCqCJ-p7523z2jM83wBSGLkGmOyyPMeA6iJ9n1M7uLm9G4QDw-ndPm1-oUiT5jVLLlXKTZSNiSJ6zaFdrWOqbaDtml_Vnuh1w_Ml7kiIwHXm86QLcOAr6INm3cdu-&sig=Cg0ArKJSzNKsFvJ4ySHpEAE&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 May 2021 05:45:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Mon, 31 May 2021 05:45:50 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A74B 10 KB
8 KB 22ms
22ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210524&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2059963059415547&plah=www.manicapost.co.zw&amaexp=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

941c473a662a1536d549296a33a95be32cd338f8e9564b053ae19d201f9f2791

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7953
x-xss-protection: 0

GET
H/1.1 200
OK n58foxedl1c4 Show response
hal9000.redintelligence.net/zone/ Frame 9877 11 KB
4 KB 95ms
31ms Script
text/html 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/n58foxedl1c4?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1st8DXi0YO2KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9A4P9fWJ9jp9aclD4xEu9AADW7w_ppt5K5s-SJpCdNQ5CKJDDnnUymsHIjE7Oa7By0ctQW32rDmu-5OknxG0ekWt3AL4LXVbZ1WfCcxnZYbnM2uFaoEkvtEPaeZIJNazlO87UHarEwYr_eV6uUFPbsmL1b6wAkjc9aB1xX2aMHKmMMN5pkqBajuyQ7a8BSQN9vo956v2loPJsOQFOUoa0jjdgv7gjZEcxbMhMsO6rQpwK-TnFuEdxXwN0kxIPphUNXdxJDov0YNziBAKgAAHMs9U_kBGPQaCb_mp-_LRNN6b2lyDlRABxRu6UtQdTrNhnPdAN8MIvf1jspMEKXLGgnABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoU-TCyfFq2ZGik4BA8xSDkvL8TA%26sig%3DAOD64_3_IW8U_aNaDzRoCnsVuCOeZwDDaQ%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-D48u-kabO6Bywq4Dbgwk05bTkXHVk-RGsqFeAmLX2OSg0lT3C8LXV0lH8jqYvKCClhFx7AkhMsVnXGII-p3Ru8ryJW1HeYPCm88cv5aj3iKpSyGnzqVIlKU7Tah4DZBUdK_ir_n4CgFOffaCdXBQYO1F87kQ%26cry%3D1%26dbm_d%3DAKAmf-A3mBHZnBfbXII5oZrXei1iylGNM0sZ9pbRp6m3_Hw_PM0uNjlODkiUFLNuMqKbKnrUt1bG1FuqPzdLRSsvOG5BHh_BbvBvdY5Xv4waipYlV0YrZHhvW68CGOSZks7M5VaEIunUp0va1zTmE7mBSPdbf5uUUMc4ytcBB9eqVOH-joYp5SCrAJKkS4Ou9bT29nsGalr9Ar7rdYQrt1dbjlkUzqERt4TBMsAmbLqbTSmDTo0tfxnQW9XmYQspKXMjgZE5t5oZ0Kfocdd-QozFCG58oKwLxVRdVh9NKbtJysLGShB6ZYtHP21uqpgsewM-RxLlqLKIaeuo_3c_0mm8EVpX14NVte1jVCG3rWcVBLRlrjiuLscAg0y8Lf-qNr-twZwPh1KcSvF-ohpIfsE4jhKFtSZylQ-2UFJq97Nmuhc3svrwaDnXZnp4vCPghzkdxPMeYrC0%26adurl%3D
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: fe82e851c99caf56c41e2b2228220475ec600ad8266b46b66d4c993b122ef363

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:50 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3929
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 8d7ecc08eab94b960bcaef5ffc03514d.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 9 KB
9 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/8d7ecc08eab94b960bcaef5ffc03514d.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

559887ee3ed9c6647e83bca9be99f2a8fc4586d11457dd96231259a5c09d5eb2

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9000
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 be864b9889d0607eafaaf0a5ccfe41e9.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 4 KB
4 KB 8ms
6ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/be864b9889d0607eafaaf0a5ccfe41e9.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d563ab5c6b46551718ad9ee5ef1ae828c64c2f9c7fb697f19fc7526566c9890a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4307
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 8c9879862fc691cac4c7a802216abd26.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 5 KB
5 KB 8ms
6ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/8c9879862fc691cac4c7a802216abd26.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

062fc1ec27743765f8fe8ea17b7aa2f5c4cb440bb15c2c6cc4b384a140a34bee

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 138140
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4971
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Sat, 29 May 2021 15:23:30 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 15:23:30 GMT

GET
H3-29 200 1818b7b853f9ab8ab089dee30d8be270.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 5 KB
5 KB 9ms
6ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/1818b7b853f9ab8ab089dee30d8be270.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c71387ab708c1c8e4f7d83aff28378dc95f6864d6c99a9118ce32d16ee4865a4

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5150
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 919645c043ab2a9a53ffd64501754e9f.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 19 KB
19 KB 10ms
8ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/919645c043ab2a9a53ffd64501754e9f.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16ba4d835e9b44c688b2a7b7ae400bab62db6eb945f836bd7ff3a20df39cb4ff

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19484
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 9ba0e05d7a3768d4770c96c6719681e3.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 3 KB
1 KB 10ms
9ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/9ba0e05d7a3768d4770c96c6719681e3.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11204abca2bebfba977f8d457cb0aa9a207167cebdb878f6177f26ef9cbc239f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1166
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 2f9ac4478d65aafc09386aa93c251ab7.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 2 KB
2 KB 11ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/2f9ac4478d65aafc09386aa93c251ab7.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e3e5c9da4ee2b652cd6cb34229147697def38f5cb79b9533b4a45daaef88af25

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1854
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 8a94c402746079cacd04f962f53034d6.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 410 B
319 B 11ms
9ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/8a94c402746079cacd04f962f53034d6.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

178f3d1421cd3d41c37445c258992b6299cb88f732c08ba2524ed06332c9f61f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 286
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 4d94673d5b278b12eabea83f4b4b3ae1.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 2 KB
803 B 11ms
10ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/4d94673d5b278b12eabea83f4b4b3ae1.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d336cb925fcfdf4ba8d70c944d8b5ccfe30515f456ae06f58044cd5bfe261838

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 770
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 95bf90d1ef70a64031fa0c69455bbf9d.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 2 KB
2 KB 11ms
10ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/95bf90d1ef70a64031fa0c69455bbf9d.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/8c3a7777bbd8e2b1a877158e6eab1276.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

431109939c869edef966caefbc34cb613c3236c74bcd80b3caf5e2d46607bf09

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2341
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H/1.1 200
OK n58foxedl1c4 Show response
hal9000.redintelligence.net/zone/ Frame 670F 11 KB
4 KB 83ms
27ms Script
text/html 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/n58foxedl1c4?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7btvDXi0YO6KBoqy3gPnkK3YBuKw3PBf0-zv6fcM8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9CBT9EGQjj7v1D8HtCUq82QGQ3PFDBxvBoXWQ8EjLOVayDWF93e7KxR9I3rKpAoxqCE5txo4-XLMWLyqY4RbKI9dFEIdHAgWKkfM0_MQnd_1-sZrVLlb9RZD9Lqt_RI04qFbCopCO-1VC1iKAlkVdVEnvFXn5sL9FTuChNHywiKZWiPTQb8SuBcgC1dCPFV73Z-xl0QKFx3FGtHcwDTR83aTG7GjSyokBm71sXhWkjtTTKfHjfIL93BK0d8yY6Y8ddKsNl0EFKnQekQmAmK77WP4wbnjYziJivR-mwu26LgxcSKm_fwU6L-fI9Pfl6o0L2txooIzjgJ3ybPC9yyLRjABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoj0YP9TWA234Q8egzIX4xsf6WrQ%26sig%3DAOD64_1BjlleptztDisYjZhJyBbIaDByog%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-CT_QIYuWpd0J-CpxUmvc8W56CklXU083AyXtlzc5ci00qO6TxIQ6P0XR-BXi80wuEF7xCX4erCDbKDlAOv7_45JklWKfCGkJxFMcDUXxY4Hq1K7ckKtSAIm1xegQBZkdlJ0afhWhxgdcjZlNNO-x4uubiHSw%26cry%3D1%26dbm_d%3DAKAmf-AJnnCGM0OwDPSoJS_sWuGJrOY_XNPdCp5Ze-If8_09V28JMqG28Iid8hI-atxVdnN5UsEk0rVKmX8mzgEf8byWB-3RMMtRPESwqzieugnW8E1Pcw9o_dL5f8WW_E71vvbTbzr_EYDWg6ccf_PKZu7V5jkMD_B0a84oI1kSjNUQ_HnAF4KhWUKANyvauF1Gh4jfAmegM6iB6LPbZ2_NReXtOJrEyoC_UkAyaWq6exTZJ68Fv0uhbLmbce6NiAfwuZ96wGVX33F3dD3X5LHKxApakfpFOEJe712x3xbSUotfSgnFlP9ZxcBwASsiP49LjD-Ifx_jhXkZ0uXD8EMbLFxbsMkg5GAxE-1zgChLpEDA8sZqiinlVRtH_gJubtOFoUBgLszzzppFxWvOk-jGB8vifkDQ6L9Gv2OsmloXtxmYzZFMZZp4dncmPTeknU2e581NbfzX1UOdFpEkYAju4C9G7N0TWA%26adurl%3D
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 50eeeac8e79f59f5775da352f650d0de7def7c3cff6e7d48c94b923eece0e27b

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:50 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3952
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK n58foxedl1c4 Show response
hal9000.redintelligence.net/zone/ Frame 9B19 11 KB
4 KB 100ms
31ms Script
text/html 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/n58foxedl1c4?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCG3-MDXi0YO-KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9DIXIWgque2KNtCIzNLYcT1-UKc6Om05Opc5F679rQh89xtP07tPsOk8mK9217-aQKWcmPlDhgR6oEkYz1V9F4Oy6J2qwFfXnhJZ_HKrt1XRh2GZPS5LUi-jvZjuEzHX-x2XdgRFYOOsstwha4scqVotbTn3hIMItt8jvLnDfnzYfL0a3iQhfDiJ3svvj-cjScqHDwi171A3oICkF7CSgP3FIc2Ql5WDex1wTbubeMLQZNRsanaKgetURl15Z3eOBB_umEakPEGTHq3io88IkPM3Qrxtcp7YQ_DQhqzXyg5z_5eoDvVriz9fHsu7SYbb7E3Kw89eizQypJ_sf_Kpa7ABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoG0XgkhdZ0QiMU6uU2yIlJ07PmQ%26sig%3DAOD64_37XUHQ7DdajSn_PGsQhjPz4S7K9w%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-AyWQIDgmK7cIPvrzBJB1mgnAfWRqB1iyvGhCrmqedZoqo5pcrwSYbknpYwLLg7iYkHMF150V-aj4y0gGNJhL7v45RB8kO4tJ6fwwBoK46fMnmBQlEQZUPVvX8LARnGMys6XgaFngdN-XJM5rhb0Qpwk2IdaQ%26cry%3D1%26dbm_d%3DAKAmf-AV-GjkGOXP2GI8xSA4b3b-Tv-rxwSmAHLa18z2pT8NXjnlzfmCA7hKTHytA9rT5tOkg0pG6IVY53mswPdAkzNxhUgyTbJnlGvLexXCuRY8CpuS0mXMVwHQsbVUN6vPdRKQ2n8xR-96_M9srsNMFZAA5E4JrgZpGzN7vWdq9dxAudLs_gds14bhv6wUokRtkAVELTACeuZXsNuWb4Ep3lSuLelN7ZTFwvVt_E6rH2wr1d5a8mAXYRKTPZ3GQlAvWLkaJUaPn4HbX_VbcA_ikipbIHAP4UyGDFx7Wvl19HSGy9WwquRtgcTNncn7YWAzHr5p9YkOgZ_vDzlLoKUv_ze9kWS-cUp2RHikX6ZmweAG47ASBY5oVP8FO7xlmKcfY2Svy3ovnv8KOXFVf7xaypHdcIa_DaMBqZc-8hz3aPoqXcS-pPeKqbkX5dP9mw0lfB6c4vsv%26adurl%3D
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 8e40130ad817f54b4dff6c42ae6f64dce1f2abdb307fe5e6fa8bd0ef1f6c1b2e

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:50 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3930
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 8d7ecc08eab94b960bcaef5ffc03514d.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 9 KB
9 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/8d7ecc08eab94b960bcaef5ffc03514d.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

559887ee3ed9c6647e83bca9be99f2a8fc4586d11457dd96231259a5c09d5eb2

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9000
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 be864b9889d0607eafaaf0a5ccfe41e9.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 4 KB
4 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/be864b9889d0607eafaaf0a5ccfe41e9.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d563ab5c6b46551718ad9ee5ef1ae828c64c2f9c7fb697f19fc7526566c9890a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4307
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 8c9879862fc691cac4c7a802216abd26.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 5 KB
5 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/8c9879862fc691cac4c7a802216abd26.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

062fc1ec27743765f8fe8ea17b7aa2f5c4cb440bb15c2c6cc4b384a140a34bee

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 138140
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4971
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Sat, 29 May 2021 15:23:30 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 15:23:30 GMT

GET
H3-29 200 1818b7b853f9ab8ab089dee30d8be270.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 5 KB
5 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/1818b7b853f9ab8ab089dee30d8be270.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c71387ab708c1c8e4f7d83aff28378dc95f6864d6c99a9118ce32d16ee4865a4

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5150
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 919645c043ab2a9a53ffd64501754e9f.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 19 KB
19 KB 8ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/919645c043ab2a9a53ffd64501754e9f.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16ba4d835e9b44c688b2a7b7ae400bab62db6eb945f836bd7ff3a20df39cb4ff

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19484
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 2f9ac4478d65aafc09386aa93c251ab7.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 2 KB
2 KB 8ms
8ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/2f9ac4478d65aafc09386aa93c251ab7.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e3e5c9da4ee2b652cd6cb34229147697def38f5cb79b9533b4a45daaef88af25

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1854
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 95bf90d1ef70a64031fa0c69455bbf9d.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame E1D5 2 KB
2 KB 9ms
8ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/95bf90d1ef70a64031fa0c69455bbf9d.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

431109939c869edef966caefbc34cb613c3236c74bcd80b3caf5e2d46607bf09

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2341
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A74B 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2059963059415547&plah=www.manicapost.co.zw&amaexp=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:50 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/8d7ecc08eab94b960bcaef5ffc03514d.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

559887ee3ed9c6647e83bca9be99f2a8fc4586d11457dd96231259a5c09d5eb2

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9000
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 be864b9889d0607eafaaf0a5ccfe41e9.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 4 KB
4 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/be864b9889d0607eafaaf0a5ccfe41e9.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d563ab5c6b46551718ad9ee5ef1ae828c64c2f9c7fb697f19fc7526566c9890a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4307
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 8c9879862fc691cac4c7a802216abd26.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 5 KB
5 KB 10ms
9ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/8c9879862fc691cac4c7a802216abd26.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

062fc1ec27743765f8fe8ea17b7aa2f5c4cb440bb15c2c6cc4b384a140a34bee

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 138140
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4971
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Sat, 29 May 2021 15:23:30 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 15:23:30 GMT

GET
H3-29 200 1818b7b853f9ab8ab089dee30d8be270.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 5 KB
5 KB 10ms
9ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/1818b7b853f9ab8ab089dee30d8be270.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c71387ab708c1c8e4f7d83aff28378dc95f6864d6c99a9118ce32d16ee4865a4

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5150
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 919645c043ab2a9a53ffd64501754e9f.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 19 KB
19 KB 11ms
10ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/919645c043ab2a9a53ffd64501754e9f.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16ba4d835e9b44c688b2a7b7ae400bab62db6eb945f836bd7ff3a20df39cb4ff

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19484
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 2f9ac4478d65aafc09386aa93c251ab7.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 2 KB
2 KB 11ms
10ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/2f9ac4478d65aafc09386aa93c251ab7.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e3e5c9da4ee2b652cd6cb34229147697def38f5cb79b9533b4a45daaef88af25

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1854
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29 200 95bf90d1ef70a64031fa0c69455bbf9d.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/ Frame 7EF0 2 KB
2 KB 11ms
11ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/media/95bf90d1ef70a64031fa0c69455bbf9d.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/11829745323518310093/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

431109939c869edef966caefbc34cb613c3236c74bcd80b3caf5e2d46607bf09

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 594250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2341
x-xss-protection: 0
last-modified: Mon, 10 May 2021 06:53:36 GMT
server: sffe
date: Mon, 24 May 2021 08:41:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 08:41:40 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F6EB
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
14ms

Document
text/html

2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUne4ScALci5hlIA3IWuOesl6S2-R_epeDnNoxbhjA6Phd2Wj1LR8WKhUkBEk44; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:50 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 31-May-2021 06:45:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 31 May 2021 05:45:50 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:50 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D8F5
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

22ms
22ms

Document
text/html

2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUne4ScALci5hlIA3IWuOesl6S2-R_epeDnNoxbhjA6Phd2Wj1LR8WKhUkBEk44; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:50 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 31-May-2021 06:45:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 31 May 2021 05:45:50 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:50 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9937
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

22ms
21ms

Document
text/html

2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUne4ScALci5hlIA3IWuOesl6S2-R_epeDnNoxbhjA6Phd2Wj1LR8WKhUkBEk44; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:50 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 31-May-2021 06:45:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 31 May 2021 05:45:50 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 31 May 2021 05:45:50 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 8AF3 12 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Mon, 31 May 2021 03:52:39 GMT
expires: Tue, 31 May 2022 03:52:39 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 6791
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame F44D 783 B
531 B 17ms
15ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e1779cc27bcf139f9fd17807dc18a301e289a7bf52b8afece2457a01efb3c63e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-QcoLOcZsF/jV+yUrN/m28w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.manicapost.co.zw/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.manicapost.co.zw/

Response headers

expires: Mon, 31 May 2021 05:45:50 GMT
date: Mon, 31 May 2021 05:45:50 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-QcoLOcZsF/jV+yUrN/m28w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js Show response
pagead2.googlesyndication.com/bg/ Frame 3E98 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03f14357b2de695aa54c32f6aa655da2e30c383035c0cead7234c80517f7740b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 17 May 2021 11:28:00 GMT
server: sffe
age: 35282
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5771
x-xss-protection: 0
expires: Mon, 30 May 2022 19:57:48 GMT

GET
H3-29 200 overkapping-Huib-van-Helden-1-.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/ Frame 3587 46 KB
46 KB 9ms
7ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/overkapping-Huib-van-Helden-1-.jpg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a2836991c49b40f0104e7f29465d3270f143b33a05632131801767a67cab20bc

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 578130
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46670
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 11:56:47 GMT
server: sffe
date: Mon, 24 May 2021 13:10:20 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 13:10:20 GMT

GET
H3-29 200 ron-kieftenbelt-veranda-berging-eiken-douglas-cedar.jpeg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/ Frame 3587 23 KB
23 KB 10ms
8ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/ron-kieftenbelt-veranda-berging-eiken-douglas-cedar.jpeg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6ddd53004785a0c3ef56db4874a4d6d04540f5f4ba3ef94fc58533b8631f024

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 578130
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23970
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 11:56:47 GMT
server: sffe
date: Mon, 24 May 2021 13:10:20 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 May 2022 13:10:20 GMT

GET
H3-29 200 overkapping-Anne-t-mannetje-1-.jpeg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/ Frame 3587 9 KB
9 KB 9ms
8ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/overkapping-Anne-t-mannetje-1-.jpeg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dcb5c723a611485bc2f009b6a534d263a9186d21d62e5d0eccdd56b8929c93b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 238669
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9298
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 11:56:47 GMT
server: sffe
date: Fri, 28 May 2021 11:28:01 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 28 May 2022 11:28:01 GMT

GET
H3-29 200 PontMeyer-logo.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/ Frame 3587 15 KB
15 KB 10ms
8ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15338438512577467951/PontMeyer-logo.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0db25ef51be4da97c1c3039bc99b071777499088e6b4d4902350f92c9d99075

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 162530
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14928
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 11:56:47 GMT
server: sffe
date: Sat, 29 May 2021 08:37:00 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 May 2022 08:37:00 GMT

GET
H3-29 200 A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js Show response
pagead2.googlesyndication.com/bg/ Frame 4027 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03f14357b2de695aa54c32f6aa655da2e30c383035c0cead7234c80517f7740b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 17 May 2021 11:28:00 GMT
server: sffe
age: 35282
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5771
x-xss-protection: 0
expires: Mon, 30 May 2022 19:57:48 GMT

GET
H3-29 200 A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js Show response
pagead2.googlesyndication.com/bg/ Frame 3EBB 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03f14357b2de695aa54c32f6aa655da2e30c383035c0cead7234c80517f7740b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 17 May 2021 11:28:00 GMT
server: sffe
age: 35282
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5771
x-xss-protection: 0
expires: Mon, 30 May 2022 19:57:48 GMT

GET
H/1.1

200
OK

request.php Show response
hal900017.redintelligence.net/ Frame 670F
Redirect Chain

https://hal900017.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=3e70f147b9&subid=&uid=f2f93be0ff40bf05&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900017.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=3e70f147b9&subid=&uid=f2f93be0ff40bf05&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

2 KB
2 KB

149ms
90ms

Script
application/x-javascript

159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=3e70f147b9&subid=&uid=f2f93be0ff40bf05&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7btvDXi0YO6KBoqy3gPnkK3YBuKw3PBf0-zv6fcM8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9CBT9EGQjj7v1D8HtCUq82QGQ3PFDBxvBoXWQ8EjLOVayDWF93e7KxR9I3rKpAoxqCE5txo4-XLMWLyqY4RbKI9dFEIdHAgWKkfM0_MQnd_1-sZrVLlb9RZD9Lqt_RI04qFbCopCO-1VC1iKAlkVdVEnvFXn5sL9FTuChNHywiKZWiPTQb8SuBcgC1dCPFV73Z-xl0QKFx3FGtHcwDTR83aTG7GjSyokBm71sXhWkjtTTKfHjfIL93BK0d8yY6Y8ddKsNl0EFKnQekQmAmK77WP4wbnjYziJivR-mwu26LgxcSKm_fwU6L-fI9Pfl6o0L2txooIzjgJ3ybPC9yyLRjABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoj0YP9TWA234Q8egzIX4xsf6WrQ%26sig%3DAOD64_1BjlleptztDisYjZhJyBbIaDByog%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-CT_QIYuWpd0J-CpxUmvc8W56CklXU083AyXtlzc5ci00qO6TxIQ6P0XR-BXi80wuEF7xCX4erCDbKDlAOv7_45JklWKfCGkJxFMcDUXxY4Hq1K7ckKtSAIm1xegQBZkdlJ0afhWhxgdcjZlNNO-x4uubiHSw%26cry%3D1%26dbm_d%3DAKAmf-AJnnCGM0OwDPSoJS_sWuGJrOY_XNPdCp5Ze-If8_09V28JMqG28Iid8hI-atxVdnN5UsEk0rVKmX8mzgEf8byWB-3RMMtRPESwqzieugnW8E1Pcw9o_dL5f8WW_E71vvbTbzr_EYDWg6ccf_PKZu7V5jkMD_B0a84oI1kSjNUQ_HnAF4KhWUKANyvauF1Gh4jfAmegM6iB6LPbZ2_NReXtOJrEyoC_UkAyaWq6exTZJ68Fv0uhbLmbce6NiAfwuZ96wGVX33F3dD3X5LHKxApakfpFOEJe712x3xbSUotfSgnFlP9ZxcBwASsiP49LjD-Ifx_jhXkZ0uXD8EMbLFxbsMkg5GAxE-1zgChLpEDA8sZqiinlVRtH_gJubtOFoUBgLszzzppFxWvOk-jGB8vifkDQ6L9Gv2OsmloXtxmYzZFMZZp4dncmPTeknU2e581NbfzX1UOdFpEkYAju4C9G7N0TWA%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=6252508110184&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: d70519c813d7ba3385be6e3b5b62483985d4e62be9dde3f1555cac8b9a1c80c1

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 31 May 2021 05:45:51 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 93147700025802000719608011611017
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 950
Expires: Mon, 31 May 2021 06:45:51 +0200

Redirect headers

Pragma: no-cache
Date: Mon, 31 May 2021 05:45:51 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=3e70f147b9&subid=&uid=f2f93be0ff40bf05&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7btvDXi0YO6KBoqy3gPnkK3YBuKw3PBf0-zv6fcM8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9CBT9EGQjj7v1D8HtCUq82QGQ3PFDBxvBoXWQ8EjLOVayDWF93e7KxR9I3rKpAoxqCE5txo4-XLMWLyqY4RbKI9dFEIdHAgWKkfM0_MQnd_1-sZrVLlb9RZD9Lqt_RI04qFbCopCO-1VC1iKAlkVdVEnvFXn5sL9FTuChNHywiKZWiPTQb8SuBcgC1dCPFV73Z-xl0QKFx3FGtHcwDTR83aTG7GjSyokBm71sXhWkjtTTKfHjfIL93BK0d8yY6Y8ddKsNl0EFKnQekQmAmK77WP4wbnjYziJivR-mwu26LgxcSKm_fwU6L-fI9Pfl6o0L2txooIzjgJ3ybPC9yyLRjABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoj0YP9TWA234Q8egzIX4xsf6WrQ%26sig%3DAOD64_1BjlleptztDisYjZhJyBbIaDByog%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-CT_QIYuWpd0J-CpxUmvc8W56CklXU083AyXtlzc5ci00qO6TxIQ6P0XR-BXi80wuEF7xCX4erCDbKDlAOv7_45JklWKfCGkJxFMcDUXxY4Hq1K7ckKtSAIm1xegQBZkdlJ0afhWhxgdcjZlNNO-x4uubiHSw%26cry%3D1%26dbm_d%3DAKAmf-AJnnCGM0OwDPSoJS_sWuGJrOY_XNPdCp5Ze-If8_09V28JMqG28Iid8hI-atxVdnN5UsEk0rVKmX8mzgEf8byWB-3RMMtRPESwqzieugnW8E1Pcw9o_dL5f8WW_E71vvbTbzr_EYDWg6ccf_PKZu7V5jkMD_B0a84oI1kSjNUQ_HnAF4KhWUKANyvauF1Gh4jfAmegM6iB6LPbZ2_NReXtOJrEyoC_UkAyaWq6exTZJ68Fv0uhbLmbce6NiAfwuZ96wGVX33F3dD3X5LHKxApakfpFOEJe712x3xbSUotfSgnFlP9ZxcBwASsiP49LjD-Ifx_jhXkZ0uXD8EMbLFxbsMkg5GAxE-1zgChLpEDA8sZqiinlVRtH_gJubtOFoUBgLszzzppFxWvOk-jGB8vifkDQ6L9Gv2OsmloXtxmYzZFMZZp4dncmPTeknU2e581NbfzX1UOdFpEkYAju4C9G7N0TWA%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=6252508110184&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 31 May 2021 06:45:51 +0200

GET
H/1.1

200
OK

request.php Show response
hal900016.redintelligence.net/ Frame 9877
Redirect Chain

https://hal900016.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=ecee4080bf&subid=&uid=17259fb160e2ac3c&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900016.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=ecee4080bf&subid=&uid=17259fb160e2ac3c&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

2 KB
2 KB

135ms
82ms

Script
application/x-javascript

138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=ecee4080bf&subid=&uid=17259fb160e2ac3c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1st8DXi0YO2KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9A4P9fWJ9jp9aclD4xEu9AADW7w_ppt5K5s-SJpCdNQ5CKJDDnnUymsHIjE7Oa7By0ctQW32rDmu-5OknxG0ekWt3AL4LXVbZ1WfCcxnZYbnM2uFaoEkvtEPaeZIJNazlO87UHarEwYr_eV6uUFPbsmL1b6wAkjc9aB1xX2aMHKmMMN5pkqBajuyQ7a8BSQN9vo956v2loPJsOQFOUoa0jjdgv7gjZEcxbMhMsO6rQpwK-TnFuEdxXwN0kxIPphUNXdxJDov0YNziBAKgAAHMs9U_kBGPQaCb_mp-_LRNN6b2lyDlRABxRu6UtQdTrNhnPdAN8MIvf1jspMEKXLGgnABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoU-TCyfFq2ZGik4BA8xSDkvL8TA%26sig%3DAOD64_3_IW8U_aNaDzRoCnsVuCOeZwDDaQ%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-D48u-kabO6Bywq4Dbgwk05bTkXHVk-RGsqFeAmLX2OSg0lT3C8LXV0lH8jqYvKCClhFx7AkhMsVnXGII-p3Ru8ryJW1HeYPCm88cv5aj3iKpSyGnzqVIlKU7Tah4DZBUdK_ir_n4CgFOffaCdXBQYO1F87kQ%26cry%3D1%26dbm_d%3DAKAmf-A3mBHZnBfbXII5oZrXei1iylGNM0sZ9pbRp6m3_Hw_PM0uNjlODkiUFLNuMqKbKnrUt1bG1FuqPzdLRSsvOG5BHh_BbvBvdY5Xv4waipYlV0YrZHhvW68CGOSZks7M5VaEIunUp0va1zTmE7mBSPdbf5uUUMc4ytcBB9eqVOH-joYp5SCrAJKkS4Ou9bT29nsGalr9Ar7rdYQrt1dbjlkUzqERt4TBMsAmbLqbTSmDTo0tfxnQW9XmYQspKXMjgZE5t5oZ0Kfocdd-QozFCG58oKwLxVRdVh9NKbtJysLGShB6ZYtHP21uqpgsewM-RxLlqLKIaeuo_3c_0mm8EVpX14NVte1jVCG3rWcVBLRlrjiuLscAg0y8Lf-qNr-twZwPh1KcSvF-ohpIfsE4jhKFtSZylQ-2UFJq97Nmuhc3svrwaDnXZnp4vCPghzkdxPMeYrC0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=6723217151045&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a42adfeac5d15f6f2bfee7dbcfb996cc98bc479152aecbe135b18c5696176d95

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 31 May 2021 05:45:51 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 16167500031559200719608011611016
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 951
Expires: Mon, 31 May 2021 06:45:51 +0200

Redirect headers

Pragma: no-cache
Date: Mon, 31 May 2021 05:45:51 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=ecee4080bf&subid=&uid=17259fb160e2ac3c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1st8DXi0YO2KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9A4P9fWJ9jp9aclD4xEu9AADW7w_ppt5K5s-SJpCdNQ5CKJDDnnUymsHIjE7Oa7By0ctQW32rDmu-5OknxG0ekWt3AL4LXVbZ1WfCcxnZYbnM2uFaoEkvtEPaeZIJNazlO87UHarEwYr_eV6uUFPbsmL1b6wAkjc9aB1xX2aMHKmMMN5pkqBajuyQ7a8BSQN9vo956v2loPJsOQFOUoa0jjdgv7gjZEcxbMhMsO6rQpwK-TnFuEdxXwN0kxIPphUNXdxJDov0YNziBAKgAAHMs9U_kBGPQaCb_mp-_LRNN6b2lyDlRABxRu6UtQdTrNhnPdAN8MIvf1jspMEKXLGgnABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoU-TCyfFq2ZGik4BA8xSDkvL8TA%26sig%3DAOD64_3_IW8U_aNaDzRoCnsVuCOeZwDDaQ%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-D48u-kabO6Bywq4Dbgwk05bTkXHVk-RGsqFeAmLX2OSg0lT3C8LXV0lH8jqYvKCClhFx7AkhMsVnXGII-p3Ru8ryJW1HeYPCm88cv5aj3iKpSyGnzqVIlKU7Tah4DZBUdK_ir_n4CgFOffaCdXBQYO1F87kQ%26cry%3D1%26dbm_d%3DAKAmf-A3mBHZnBfbXII5oZrXei1iylGNM0sZ9pbRp6m3_Hw_PM0uNjlODkiUFLNuMqKbKnrUt1bG1FuqPzdLRSsvOG5BHh_BbvBvdY5Xv4waipYlV0YrZHhvW68CGOSZks7M5VaEIunUp0va1zTmE7mBSPdbf5uUUMc4ytcBB9eqVOH-joYp5SCrAJKkS4Ou9bT29nsGalr9Ar7rdYQrt1dbjlkUzqERt4TBMsAmbLqbTSmDTo0tfxnQW9XmYQspKXMjgZE5t5oZ0Kfocdd-QozFCG58oKwLxVRdVh9NKbtJysLGShB6ZYtHP21uqpgsewM-RxLlqLKIaeuo_3c_0mm8EVpX14NVte1jVCG3rWcVBLRlrjiuLscAg0y8Lf-qNr-twZwPh1KcSvF-ohpIfsE4jhKFtSZylQ-2UFJq97Nmuhc3svrwaDnXZnp4vCPghzkdxPMeYrC0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=6723217151045&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 31 May 2021 06:45:51 +0200

GET
H/1.1

200
OK

request.php Show response
hal90006.redintelligence.net/ Frame 9B19
Redirect Chain

https://hal90006.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=117e963c18&subid=&uid=55061b47689d8297&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90006.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=117e963c18&subid=&uid=55061b47689d8297&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

2 KB
2 KB

133ms
81ms

Script
application/x-javascript

138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=117e963c18&subid=&uid=55061b47689d8297&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCG3-MDXi0YO-KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9DIXIWgque2KNtCIzNLYcT1-UKc6Om05Opc5F679rQh89xtP07tPsOk8mK9217-aQKWcmPlDhgR6oEkYz1V9F4Oy6J2qwFfXnhJZ_HKrt1XRh2GZPS5LUi-jvZjuEzHX-x2XdgRFYOOsstwha4scqVotbTn3hIMItt8jvLnDfnzYfL0a3iQhfDiJ3svvj-cjScqHDwi171A3oICkF7CSgP3FIc2Ql5WDex1wTbubeMLQZNRsanaKgetURl15Z3eOBB_umEakPEGTHq3io88IkPM3Qrxtcp7YQ_DQhqzXyg5z_5eoDvVriz9fHsu7SYbb7E3Kw89eizQypJ_sf_Kpa7ABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoG0XgkhdZ0QiMU6uU2yIlJ07PmQ%26sig%3DAOD64_37XUHQ7DdajSn_PGsQhjPz4S7K9w%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-AyWQIDgmK7cIPvrzBJB1mgnAfWRqB1iyvGhCrmqedZoqo5pcrwSYbknpYwLLg7iYkHMF150V-aj4y0gGNJhL7v45RB8kO4tJ6fwwBoK46fMnmBQlEQZUPVvX8LARnGMys6XgaFngdN-XJM5rhb0Qpwk2IdaQ%26cry%3D1%26dbm_d%3DAKAmf-AV-GjkGOXP2GI8xSA4b3b-Tv-rxwSmAHLa18z2pT8NXjnlzfmCA7hKTHytA9rT5tOkg0pG6IVY53mswPdAkzNxhUgyTbJnlGvLexXCuRY8CpuS0mXMVwHQsbVUN6vPdRKQ2n8xR-96_M9srsNMFZAA5E4JrgZpGzN7vWdq9dxAudLs_gds14bhv6wUokRtkAVELTACeuZXsNuWb4Ep3lSuLelN7ZTFwvVt_E6rH2wr1d5a8mAXYRKTPZ3GQlAvWLkaJUaPn4HbX_VbcA_ikipbIHAP4UyGDFx7Wvl19HSGy9WwquRtgcTNncn7YWAzHr5p9YkOgZ_vDzlLoKUv_ze9kWS-cUp2RHikX6ZmweAG47ASBY5oVP8FO7xlmKcfY2Svy3ovnv8KOXFVf7xaypHdcIa_DaMBqZc-8hz3aPoqXcS-pPeKqbkX5dP9mw0lfB6c4vsv%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=7926937498705&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5d11bfaf0ec10d9aa65518e0c8c4a3cfe3d7bb6a5cbac94d48ba54921d18b858

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 31 May 2021 05:45:51 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 25646200030154900719608011611006
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 952
Expires: Mon, 31 May 2021 06:45:51 +0200

Redirect headers

Pragma: no-cache
Date: Mon, 31 May 2021 05:45:51 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=117e963c18&subid=&uid=55061b47689d8297&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCG3-MDXi0YO-KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9DIXIWgque2KNtCIzNLYcT1-UKc6Om05Opc5F679rQh89xtP07tPsOk8mK9217-aQKWcmPlDhgR6oEkYz1V9F4Oy6J2qwFfXnhJZ_HKrt1XRh2GZPS5LUi-jvZjuEzHX-x2XdgRFYOOsstwha4scqVotbTn3hIMItt8jvLnDfnzYfL0a3iQhfDiJ3svvj-cjScqHDwi171A3oICkF7CSgP3FIc2Ql5WDex1wTbubeMLQZNRsanaKgetURl15Z3eOBB_umEakPEGTHq3io88IkPM3Qrxtcp7YQ_DQhqzXyg5z_5eoDvVriz9fHsu7SYbb7E3Kw89eizQypJ_sf_Kpa7ABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoG0XgkhdZ0QiMU6uU2yIlJ07PmQ%26sig%3DAOD64_37XUHQ7DdajSn_PGsQhjPz4S7K9w%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-AyWQIDgmK7cIPvrzBJB1mgnAfWRqB1iyvGhCrmqedZoqo5pcrwSYbknpYwLLg7iYkHMF150V-aj4y0gGNJhL7v45RB8kO4tJ6fwwBoK46fMnmBQlEQZUPVvX8LARnGMys6XgaFngdN-XJM5rhb0Qpwk2IdaQ%26cry%3D1%26dbm_d%3DAKAmf-AV-GjkGOXP2GI8xSA4b3b-Tv-rxwSmAHLa18z2pT8NXjnlzfmCA7hKTHytA9rT5tOkg0pG6IVY53mswPdAkzNxhUgyTbJnlGvLexXCuRY8CpuS0mXMVwHQsbVUN6vPdRKQ2n8xR-96_M9srsNMFZAA5E4JrgZpGzN7vWdq9dxAudLs_gds14bhv6wUokRtkAVELTACeuZXsNuWb4Ep3lSuLelN7ZTFwvVt_E6rH2wr1d5a8mAXYRKTPZ3GQlAvWLkaJUaPn4HbX_VbcA_ikipbIHAP4UyGDFx7Wvl19HSGy9WwquRtgcTNncn7YWAzHr5p9YkOgZ_vDzlLoKUv_ze9kWS-cUp2RHikX6ZmweAG47ASBY5oVP8FO7xlmKcfY2Svy3ovnv8KOXFVf7xaypHdcIa_DaMBqZc-8hz3aPoqXcS-pPeKqbkX5dP9mw0lfB6c4vsv%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=7926937498705&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 31 May 2021 06:45:51 +0200

GET
H3-29 200 A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js Show response
pagead2.googlesyndication.com/bg/ Frame 8AF3 14 KB
6 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03f14357b2de695aa54c32f6aa655da2e30c383035c0cead7234c80517f7740b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 17 May 2021 11:28:00 GMT
server: sffe
age: 35283
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5771
x-xss-protection: 0
expires: Mon, 30 May 2022 19:57:48 GMT

POST
H2 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame C24B 28 B
321 B 21ms
21ms XHR
application/json 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/0b643cd1/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json
X-YouTube-Utc-Offset: 120
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/
X-YouTube-Client-Version: 1.20210526.1.0
X-YouTube-Time-Zone: Europe/Berlin
X-Goog-Visitor-Id: Cgtac0ttbTltSk5fYyiM8NGFBg%3D%3D
X-YouTube-Ad-Signals: dt=1622439949055&flash=0&frm=2&u_tz=120&u_his=2&u_java&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug&u_nmime&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C420%2C230&vis=1&wgl=true&ca_type=image&bid=ANyPxKoonGf0LpfAXqoYFmi2IqP_o7mx-WQhZdWbfZuYvEhk2ENqbIj5uAm6VA5BtWPLGeh7EkTKasY4_v43aayHbDfrUl2VKg

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31
x-xss-protection: 0
expires: Mon, 31 May 2021 05:45:51 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3E98 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BghixDni0YPvpH5rG7_UPhIe16AUAAAAAOAHgBAI&bg=!AAOlA0fNAAaMan2LjGo7ACkAdvg8Wp2lCp9WXI0xhQNzV8oPQrmzQOJHUjZBziErGP31DLkZLobRAAIAAADCUgAAABdoAQeZApY18R47tEqQ7zgeL3lgQeYMGSoKxIsbIlI-RF1jKvMObz1j6RIGi6MJFi-Bjoht9HYyIKyDvpnmHDUbKzhoKGgcqngIAJ7XOACZNgOkBzmjBwbm_CMD_INgpzUbzesAoLeXPlyGTAVMGlkSMSFdUsGmh-rpA3nOK2Kfes9eXDnH4L8awtsHYdzaliaFQIuAD0uwYa7jLYw5_gO6ObObKD9kb2s1n9HbvQVu8o-gtT5vnpCwnZ2Fg6vdJqYXbDsMDl_WHmMiTm_UuBmp1-4K12ea330u9ufUPbL-ywJqirzN3LpwmXHI5F3WDX5b3BhaX6CcGK6-Y_em8W2DPVQJ9w7-Z0G78RXps8yJ5nzwqZ0eTXJIq81HAByw4XT2QD1aM4oUKJI1DQQQB4MEotAyFsj22siFAeZ4Iv4-yIyIthvAVYyE2oYIv9DwoRWSzW5m4PeG3IR8BcFYnNAPlhGvh2igziZoU5tHdPygixMyyyMgEPzLQqYuc8mAE5HT80c_CExe1CDxzMnAE5UZTUyk_g8BmjFFfFGjEMwU8fgv8x_pOev0_86YoET-v3XEM38UOJEkOshj6P7RBTtBKuEjQqcSzFZ5teB4UyYQavIyHrXWv2T01BkvooXr_Yp1eM9O3ME3ulgqXe96kgjHZ-Ne6G1EsEIBjVkS24R2IeKW_hLsWW5F9IwRLHdJ-ibmeBixn9Lwb3UAR0mLbWxVy58BscP4HEtv2sGcCJH8wyNRMkCS-EgHtWgPfwRUlXH7lOFDUp_WjOqF12YpbEo3j8VAGAEfnMcy_Kpnk_fVHjAkEjJpsdtOk2x5Q7BXVPLtIpKFaKin5pjTplKUHkgbjnhaGyMKzyWslMEJatmzGPUsuXYhCVnnFJQN0w

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3EBB 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B_v87Dni0YO3xIJaUgQfzw4LQBgAAAAA4AeAEAg&bg=!3d6l3prNAAaMan2LjGo7ACkAdvg8Wh-fkW9kvUdluhF50vRfXntDEJdp4B4osgYci_wr1xNoMMCzpgIAAACcUgAAABhoAQcKAB2d6-Voy60nZpCC4BIpTAjKy9zhA0EOMrcxtpZtv5kCjic24siFPXgaGb2x6mBa5-aYbQo79QIFl-QdiQ9oeC51JDm39GElx1oCaW78xglL2BWjMmySwM4eDxy1zOIFWQ0WMnkd0ARLhZyRnCnFh1tZbLWVBwBGEnuK7jVj1Y_eqAOBG5qJNJarl8zfBsqeg0LnEsoyHFEKbjBNDVSTRnTQXrY1VrM0K99jJckJltwNiNgCJfGVXJyESbR2nkoRF8eNaWRK3mFtaV0Ch4ckO4qE_xDUxGszcJGoai6WRZn2oix0ok3RKVFQGHoahwtxnE9DeEqeq49Ws5GnfInNvU5eh9Lj11hueSW9Z29seF5IARWRhK8v3qBXD0C1iOArvWvl3rDom_n-8JEN9LZzDDGY2iCyE128o0G25kVdVS0ovc0g8ryoxOFp2iFnFgvPa7GWTd3BzwybbczJT5flOSfLdgfpwrnO64pM2Zc5mGGmg-Z9YqD3TT6hydSXLLMEhcneNBjiCS3arnz0JDc_eJzr-iV9J5aP3I_ZR8k30LcfQ8Xqha6IEiaffkCJTVqabajXob4RK3khwBItZsT9fAoT9i52OUgdNFq0MVdaJCkLtEQ6mJViKrUORKL71-G_xcZZ0CFQWx3_OlwdP-Kabx2iWANMULDjn4q4EqkstTIDiOKm6Z2wrFJD2q9iJP3EZ8P3_1cj6OvWC_kr7DaNE2qHjHouby5aX5OEPOdXtOP8m7Gzz0clCVa0HlpQuyFtvXRSeG4DabS7MD_luPfxcb4SxTcu7Evc7J3Q8lFk8xmAwg9HdZfb0oisk_MZ5QHfK4W7id1akpNRd8X8TCzuLsT-hk1jlKw0_kYhQnP2htJd80KUSxOnJxZMBMo1n-KMQkExBoc0vo-GGWguFg5Pqg

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4027 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BRDu8Dni0YIe_IOXV7_UP18KusAgAAAAAOAHgBAI&bg=!4OOl46fNAAaMan2LjGo7ACkAdvg8Wk5rnG7I5S-awCGjg19pMl2dHQeh2qoBAzfuUA0JFL8N0zkcywIAAADkUgAAABpoAQeZApRSq0Wl5CtM-VK2CrRwrdwGe8Y9G2kUqzrDShQ7zclKP244Te8d2NhHucjK3EwuZbSXBc-xuoCYrKmwlcPY2iRLvffU0F4TCMqyinhUA47K7HBLqIAXDkp0lQOVXoi81Hpo8jK7IrMfw8lmFzxrGQUK1rUnqwtCjFhy5ACwy_HPMPXDWdat32vmK_3d6Zj9r7lK2ylCDwHMRaZgFscrCbKUAGwUk_FgkceHcKIWYuuqni2afBeH-Me7zzhLQCNrEbVzpTFCs4IwRVj4Ib1BR1xtfFR_bNcM7PdxYEcoNe_PfGxryKI7WgSuCM0zoUJ1FEzHoy1k2mRHUrYSWOtJHGhxRDWor2a7I4CpUR4Q1xNcVfSL3r6X98ZRT1cXoFXBO4mS-zTr-be4wITPVG2dF_UDGFBj7Vzexj0BSAXN-4NdDBufOmJP7_2jHfxHd7SJfEMXV-N81VpfQtbu5KD4YkjGrXx9efhD2Cbw0l9kADKcqMO74voHHFSRIK36QDNYJ7AKkLexsBrgA5HOWaLW2DgJtL2JLZ1s9c1rqR7_I2XeI4MxlPQmwHyQVyxpTmU9RUlyiQ4CqNp45KAJs8pZuybrY90mb8stoIWDGGTy4usACtG7N2vLS87q1Nh09ebfEeF_EMRb54M74TXwAt-4QtgooLzwL8oihKBTCldJf1IjatAlYVGDDbozIuEaFtqoD_rIySg17y26W3lZbTtYiFHxtJ-VV0A0wwnN77av6HQBxDypEEHCCsyEEOZt2LZSb_K4ebB_tzDdIcTc7VCw4-_0BWmwh1pI6xYV_TIbQB2uurxLOnsHgBFWIhH5K_z-Mnq-RN8TEz-PIiqHrpCo2izc0i2Vn1BF831bCnCWGOebNVMn8Uo

Requested by

Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A74B 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gda_r20210524&jk=606131567089719&bg=!REelRwPNAAaMan2LjGo7ACkAdvg8WjdtxKYkgElakHQtFUtUltxYHYV8mCHgjO2BcleiIuz6rCZvpQIAAABHUgAAAAtoAQcKAGSbRUZm4EKWa0k4naBaDk1zjvW9hIC5wGmVhbzJ7OJ3R4oYEDteJeLOVXzI2zaVJYofgCgkNmRt5uVaWKh6rWdHKyG6Zn8GqzEG5eIZ3KwDmo8jujHEe6MUnL0IklvPeWwv2-xtmQJohbKKV0mo5bjuRcjcNBUAUOjaJr1pFmlrnpT5tNNbpgGBlTE5yCFp6DewepZjt9frWwjIMtf7uHfDuBfSn65WfC1ehpmKBG5IWeU9PllSaU9uGL0gApzDn63zjvck6IdbY-QwVneEi3JiVG24b37L-Fvb7W6sdlihjmgK1Zhj5lBkJan62joHx1lM6KZNoQhRLR3IEJcYpfPa9WfW4BbGkmgzBfYQ-sgM4-LIYe4zqknw8FUDt6oCwsxsulMr6KmoB1IzRM9w8hKW2DhIX5vOw4qUqop4bm2R9Rf3tlmU6zOZeT4yyO09FKGX3h8s3EyFHcpFzO3uzMC2tKmVC5RhpbiS1PqiKcvbb8tJI5VnPCoQuIzzYv-q10lH_SE-MZf0_Yc_h1rqSNmKkbCt2EStfpGwYwu-dREkWg0P192Digmc1fZqWKwA3_hYfa30y760SQtfvLwQEfvQe52J28dGEodmMMMacjsiIJwweNWPnlG_exq9799VnyQhvejHyBgF6PVa_9B-Jj-W8SPKki9cdMm6tyNutUeGHm84kQE0XogYtqSBt7FGRobhw7MgxKVJ_rbirj6uRxSGsTO2WYFPodXMBY21t2iYiOsfeKiiVth2thI0cZ9TeLedLVJe9gEJ2ibkeLmA9UZcNtYFwPhrtvFOxtq1UbFoAh0hBXgj6Tmulpkc_kTjk4iWM3ZzUV-IIuSf__x1TTKsxTeRr2NbS4RZeV8zQl1A0izv_u_hQk4uMcq6FZ3gH74avGklzB1qKV_uiTvnCkEE6Q2Ofz4Ye47ypRE_CUWAw4hirVvC_8e_5gKVs8B9Pg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 9877 442 B
1 KB 248ms
61ms Script
text/javascript 34.246.49.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=16167500031559200719608011611016&t=js&wid=tt-213bb4
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.49.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-49-61.eu-west-1.compute.amazonaws.com
Software: nginx / PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
Resource Hash: 5f5b7b08513fceb4aae39b62d9429ae696cec9a67d2fcf09b614fb664c4bd8c4

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=utf8
server: nginx
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900016.redintelligence.net/ Frame ED88 7 KB
3 KB 89ms
30ms Document
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/request_content.php?s=16167500031559200719608011611016&a=80a24ce5
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=ecee4080bf&subid=&uid=17259fb160e2ac3c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1st8DXi0YO2KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9A4P9fWJ9jp9aclD4xEu9AADW7w_ppt5K5s-SJpCdNQ5CKJDDnnUymsHIjE7Oa7By0ctQW32rDmu-5OknxG0ekWt3AL4LXVbZ1WfCcxnZYbnM2uFaoEkvtEPaeZIJNazlO87UHarEwYr_eV6uUFPbsmL1b6wAkjc9aB1xX2aMHKmMMN5pkqBajuyQ7a8BSQN9vo956v2loPJsOQFOUoa0jjdgv7gjZEcxbMhMsO6rQpwK-TnFuEdxXwN0kxIPphUNXdxJDov0YNziBAKgAAHMs9U_kBGPQaCb_mp-_LRNN6b2lyDlRABxRu6UtQdTrNhnPdAN8MIvf1jspMEKXLGgnABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoU-TCyfFq2ZGik4BA8xSDkvL8TA%26sig%3DAOD64_3_IW8U_aNaDzRoCnsVuCOeZwDDaQ%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-D48u-kabO6Bywq4Dbgwk05bTkXHVk-RGsqFeAmLX2OSg0lT3C8LXV0lH8jqYvKCClhFx7AkhMsVnXGII-p3Ru8ryJW1HeYPCm88cv5aj3iKpSyGnzqVIlKU7Tah4DZBUdK_ir_n4CgFOffaCdXBQYO1F87kQ%26cry%3D1%26dbm_d%3DAKAmf-A3mBHZnBfbXII5oZrXei1iylGNM0sZ9pbRp6m3_Hw_PM0uNjlODkiUFLNuMqKbKnrUt1bG1FuqPzdLRSsvOG5BHh_BbvBvdY5Xv4waipYlV0YrZHhvW68CGOSZks7M5VaEIunUp0va1zTmE7mBSPdbf5uUUMc4ytcBB9eqVOH-joYp5SCrAJKkS4Ou9bT29nsGalr9Ar7rdYQrt1dbjlkUzqERt4TBMsAmbLqbTSmDTo0tfxnQW9XmYQspKXMjgZE5t5oZ0Kfocdd-QozFCG58oKwLxVRdVh9NKbtJysLGShB6ZYtHP21uqpgsewM-RxLlqLKIaeuo_3c_0mm8EVpX14NVte1jVCG3rWcVBLRlrjiuLscAg0y8Lf-qNr-twZwPh1KcSvF-ohpIfsE4jhKFtSZylQ-2UFJq97Nmuhc3svrwaDnXZnp4vCPghzkdxPMeYrC0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=6723217151045&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5208aece8c5754bc7df7cd74c2f7fc691b608dde785129405ea007cc6e9d7d18

Request headers

Host: hal900016.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=0c6e039a96a3fec7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

Date: Mon, 31 May 2021 05:45:51 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Mon, 31 May 2021 06:45:51 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2188
Connection: close
Content-Type: text/html; charset=utf-8

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 9B19 442 B
1 KB 218ms
63ms Script
text/javascript 34.246.49.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=25646200030154900719608011611006&t=js&wid=tt-1e29d5
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.49.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-49-61.eu-west-1.compute.amazonaws.com
Software: nginx / PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
Resource Hash: b6a368d36866863dcccbd259abd44ed9544c906d6eae088f743fe083afb38e17

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=utf8
server: nginx
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK request_content.php Show response
hal90006.redintelligence.net/ Frame 3ADD 7 KB
3 KB 79ms
27ms Document
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/request_content.php?s=25646200030154900719608011611006&a=510c5bc8
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=117e963c18&subid=&uid=55061b47689d8297&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCG3-MDXi0YO-KBoqy3gPnkK3YBuKw3PBf_bi9lIoL8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9DIXIWgque2KNtCIzNLYcT1-UKc6Om05Opc5F679rQh89xtP07tPsOk8mK9217-aQKWcmPlDhgR6oEkYz1V9F4Oy6J2qwFfXnhJZ_HKrt1XRh2GZPS5LUi-jvZjuEzHX-x2XdgRFYOOsstwha4scqVotbTn3hIMItt8jvLnDfnzYfL0a3iQhfDiJ3svvj-cjScqHDwi171A3oICkF7CSgP3FIc2Ql5WDex1wTbubeMLQZNRsanaKgetURl15Z3eOBB_umEakPEGTHq3io88IkPM3Qrxtcp7YQ_DQhqzXyg5z_5eoDvVriz9fHsu7SYbb7E3Kw89eizQypJ_sf_Kpa7ABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoG0XgkhdZ0QiMU6uU2yIlJ07PmQ%26sig%3DAOD64_37XUHQ7DdajSn_PGsQhjPz4S7K9w%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-AyWQIDgmK7cIPvrzBJB1mgnAfWRqB1iyvGhCrmqedZoqo5pcrwSYbknpYwLLg7iYkHMF150V-aj4y0gGNJhL7v45RB8kO4tJ6fwwBoK46fMnmBQlEQZUPVvX8LARnGMys6XgaFngdN-XJM5rhb0Qpwk2IdaQ%26cry%3D1%26dbm_d%3DAKAmf-AV-GjkGOXP2GI8xSA4b3b-Tv-rxwSmAHLa18z2pT8NXjnlzfmCA7hKTHytA9rT5tOkg0pG6IVY53mswPdAkzNxhUgyTbJnlGvLexXCuRY8CpuS0mXMVwHQsbVUN6vPdRKQ2n8xR-96_M9srsNMFZAA5E4JrgZpGzN7vWdq9dxAudLs_gds14bhv6wUokRtkAVELTACeuZXsNuWb4Ep3lSuLelN7ZTFwvVt_E6rH2wr1d5a8mAXYRKTPZ3GQlAvWLkaJUaPn4HbX_VbcA_ikipbIHAP4UyGDFx7Wvl19HSGy9WwquRtgcTNncn7YWAzHr5p9YkOgZ_vDzlLoKUv_ze9kWS-cUp2RHikX6ZmweAG47ASBY5oVP8FO7xlmKcfY2Svy3ovnv8KOXFVf7xaypHdcIa_DaMBqZc-8hz3aPoqXcS-pPeKqbkX5dP9mw0lfB6c4vsv%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=7926937498705&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0bd0b5d8e455450424584dfdc8d35761342f797305b4cdc772f7fe78a72da284

Request headers

Host: hal90006.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=e677d031860c7ac4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

Date: Mon, 31 May 2021 05:45:51 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Mon, 31 May 2021 06:45:51 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2186
Connection: close
Content-Type: text/html; charset=utf-8

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 670F 442 B
1 KB 202ms
69ms Script
text/javascript 34.246.49.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=93147700025802000719608011611017&t=js&wid=tt-4054d5
Requested by: Host: www.manicapost.co.zw
URL: https://www.manicapost.co.zw/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.49.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-49-61.eu-west-1.compute.amazonaws.com
Software: nginx / PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
Resource Hash: bd0246d176a8e007808c21b7438fc496e62ccbd28f30c1d09359fed66ad8bf95

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=utf8
server: nginx
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900017.redintelligence.net/ Frame 4C5D 7 KB
3 KB 103ms
34ms Document
text/html 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/request_content.php?s=93147700025802000719608011611017&a=2b20bbd4
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request.php?zone=n58foxedl1c4&nw=20&renderingType=javascript&namespace=3e70f147b9&subid=&uid=f2f93be0ff40bf05&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7btvDXi0YO6KBoqy3gPnkK3YBuKw3PBf0-zv6fcM8C4QASCBtfkpYJGEgID4F8gBCakC2tqn4Hx0tD6oAwGqBIECT9CBT9EGQjj7v1D8HtCUq82QGQ3PFDBxvBoXWQ8EjLOVayDWF93e7KxR9I3rKpAoxqCE5txo4-XLMWLyqY4RbKI9dFEIdHAgWKkfM0_MQnd_1-sZrVLlb9RZD9Lqt_RI04qFbCopCO-1VC1iKAlkVdVEnvFXn5sL9FTuChNHywiKZWiPTQb8SuBcgC1dCPFV73Z-xl0QKFx3FGtHcwDTR83aTG7GjSyokBm71sXhWkjtTTKfHjfIL93BK0d8yY6Y8ddKsNl0EFKnQekQmAmK77WP4wbnjYziJivR-mwu26LgxcSKm_fwU6L-fI9Pfl6o0L2txooIzjgJ3ybPC9yyLRjABNvzvffUAeAEA5AGAaAGTYAH6-foXqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATl-WyCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoj0YP9TWA234Q8egzIX4xsf6WrQ%26sig%3DAOD64_1BjlleptztDisYjZhJyBbIaDByog%26client%3Dca-pub-3993920789177136%26dbm_c%3DAKAmf-CT_QIYuWpd0J-CpxUmvc8W56CklXU083AyXtlzc5ci00qO6TxIQ6P0XR-BXi80wuEF7xCX4erCDbKDlAOv7_45JklWKfCGkJxFMcDUXxY4Hq1K7ckKtSAIm1xegQBZkdlJ0afhWhxgdcjZlNNO-x4uubiHSw%26cry%3D1%26dbm_d%3DAKAmf-AJnnCGM0OwDPSoJS_sWuGJrOY_XNPdCp5Ze-If8_09V28JMqG28Iid8hI-atxVdnN5UsEk0rVKmX8mzgEf8byWB-3RMMtRPESwqzieugnW8E1Pcw9o_dL5f8WW_E71vvbTbzr_EYDWg6ccf_PKZu7V5jkMD_B0a84oI1kSjNUQ_HnAF4KhWUKANyvauF1Gh4jfAmegM6iB6LPbZ2_NReXtOJrEyoC_UkAyaWq6exTZJ68Fv0uhbLmbce6NiAfwuZ96wGVX33F3dD3X5LHKxApakfpFOEJe712x3xbSUotfSgnFlP9ZxcBwASsiP49LjD-Ifx_jhXkZ0uXD8EMbLFxbsMkg5GAxE-1zgChLpEDA8sZqiinlVRtH_gJubtOFoUBgLszzzppFxWvOk-jGB8vifkDQ6L9Gv2OsmloXtxmYzZFMZZp4dncmPTeknU2e581NbfzX1UOdFpEkYAju4C9G7N0TWA%26adurl%3D&documentReferer=https%3A%2F%2Fwww.manicapost.co.zw%2F&ancestorOrigins=https%3A%2F%2Fwww.manicapost.co.zw&random=6252508110184&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: 1bc5157ca01888a7eb616c51664571264c25faea44718b2b90e961a85fb081fa

Request headers

Host: hal900017.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=e677d031860c7ac4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/

Response headers

Date: Mon, 31 May 2021 05:45:51 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Mon, 31 May 2021 06:45:51 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2187
Connection: close
Content-Type: text/html; charset=utf-8

GET
H3-29 200 css
fonts.googleapis.com/ Frame ED88 4 KB
648 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=16167500031559200719608011611016&a=80a24ce5

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

932060b34fe451f1cb994f3da257f6d2d0f281e1e286e9f3f0e2da63e862fec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 31 May 2021 05:34:14 GMT
server: ESF
date: Mon, 31 May 2021 05:45:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 31 May 2021 05:45:51 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame ED88 12 KB
12 KB 89ms
30ms Image
image/png 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/53619/creativesup/img220807_banners_megekko_affiliate_image_v2-1597759923086-min%20(2).jpg
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=16167500031559200719608011611016&a=80a24ce5
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 4b8f09fa5fbd09ce9bf53c4b4cd77c34637343c31421ce7941cc408e36f4b6ea

Request headers

Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:51 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 11776
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal900016.redintelligence.net/ Frame ED88 0
150 B 79ms
27ms Script
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/viewability?s=16167500031559200719608011611016&a=6cb12bb4&vb=m
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=16167500031559200719608011611016&a=80a24ce5
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal900016.redintelligence.net/request_content.php?s=16167500031559200719608011611016&a=80a24ce5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:51 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 / Show response
ti.tradetracker.net/ Frame ED88 434 B
1 KB 67ms
67ms Script
text/javascript 34.246.49.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=16167500031559200719608011611016&t=js&wid=tt-1c2fd6
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=16167500031559200719608011611016&a=80a24ce5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.49.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-49-61.eu-west-1.compute.amazonaws.com
Software: nginx / PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
Resource Hash: ad626d252ee16740043cb344578997791505552c1d006411aba5b6bd55ea9aef

Request headers

Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=utf8
server: nginx
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 / Show response
ti.tradetracker.net/ Frame ED88 457 B
1 KB 63ms
63ms Script
text/javascript 34.246.49.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=&r=16167500031559200719608011611016&t=js&wid=tt-89e6c6
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=16167500031559200719608011611016&a=80a24ce5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.49.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-49-61.eu-west-1.compute.amazonaws.com
Software: nginx / PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
Resource Hash: 1fe56e688ca09d9be11870763d7770e14eafd5d1117cd787fcaf4719d17727d2

Request headers

Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=utf8
server: nginx
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

e6244d1a4401c7fe26622998bffa5f86940922.png
static.tradetracker.net/nl/material_image/f1/ Frame 9877
Redirect Chain

https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=16167500031559200719608011611016&t=html
https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png

2 KB
2 KB

39ms
11ms

Image
image/png

2600:9000:2182:800:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:800:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a82269bce61196e0aca1c36b304de3471e367a41179284996e6b06b2a3b3009a

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:20 GMT
via: 1.1 bb45d9db269295920003af6514d7e7eb.cloudfront.net (CloudFront)
last-modified: Fri, 23 Apr 2021 10:05:11 GMT
server: nginx
age: 144
etag: "60829bd7-6cf"
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-length: 1743
x-amz-cf-id: Lgre4psL80WUKZwPadRzVZRrtEIPIc76nk-Q2nR4IW4ptcx-ncDQ2g==

Redirect headers

date: Mon, 31 May 2021 05:45:51 GMT
server: nginx
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
location: https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png
cache-control: no-cache, must-revalidate
content-type: text/html; charset=utf-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

e6244d1a4401c7fe26622998bffa5f86940922.png
static.tradetracker.net/nl/material_image/f1/ Frame 9B19
Redirect Chain

https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=25646200030154900719608011611006&t=html
https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png

2 KB
2 KB

39ms
11ms

Image
image/png

2600:9000:2182:800:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:800:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a82269bce61196e0aca1c36b304de3471e367a41179284996e6b06b2a3b3009a

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:20 GMT
via: 1.1 bb45d9db269295920003af6514d7e7eb.cloudfront.net (CloudFront)
last-modified: Fri, 23 Apr 2021 10:05:11 GMT
server: nginx
age: 144
etag: "60829bd7-6cf"
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-length: 1743
x-amz-cf-id: ScHWpBGOIsPwtWSYYN12qj_9Fqp6x--vwe_JD4faGk-x0bFyDI7Oqg==

Redirect headers

date: Mon, 31 May 2021 05:45:51 GMT
server: nginx
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
location: https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png
cache-control: no-cache, must-revalidate
content-type: text/html; charset=utf-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

e6244d1a4401c7fe26622998bffa5f86940922.png
static.tradetracker.net/nl/material_image/f1/ Frame 670F
Redirect Chain

https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=93147700025802000719608011611017&t=html
https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png

2 KB
2 KB

29ms
15ms

Image
image/png

2600:9000:2182:800:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png
Requested by: Host: d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
URL: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:800:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a82269bce61196e0aca1c36b304de3471e367a41179284996e6b06b2a3b3009a

Request headers

Referer: https://d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
via: 1.1 bb45d9db269295920003af6514d7e7eb.cloudfront.net (CloudFront)
last-modified: Fri, 23 Apr 2021 10:05:11 GMT
server: nginx
x-amz-cf-pop: DUS51-C1
etag: "60829bd7-6cf"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 1743
x-amz-cf-id: uR9-LuNXrY5xf3p8FSaWJWYUx6cXu27QIxULn4zh3-wDsjBuEy2rHQ==

Redirect headers

date: Mon, 31 May 2021 05:45:51 GMT
server: nginx
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
location: https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png
cache-control: no-cache, must-revalidate
content-type: text/html; charset=utf-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 3ADD 4 KB
648 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=25646200030154900719608011611006&a=510c5bc8

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

932060b34fe451f1cb994f3da257f6d2d0f281e1e286e9f3f0e2da63e862fec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 31 May 2021 05:29:26 GMT
server: ESF
date: Mon, 31 May 2021 05:45:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 31 May 2021 05:45:51 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3ADD 12 KB
12 KB 80ms
28ms Image
image/png 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/53619/creativesup/img220807_banners_megekko_affiliate_image_v2-1597759923086-min%20(2).jpg
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=25646200030154900719608011611006&a=510c5bc8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 4b8f09fa5fbd09ce9bf53c4b4cd77c34637343c31421ce7941cc408e36f4b6ea

Request headers

Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:51 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 11776
Vary: Accept-Encoding
Content-Type: image/png

GET
H2

200

d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
static.tradetracker.net/nl/material_image/6b/ Frame ED88
Redirect Chain

https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=16167500031559200719608011611016&t=html
https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif

18 KB
18 KB

15ms
10ms

Image
image/gif

2600:9000:2182:800:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=16167500031559200719608011611016&a=80a24ce5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:800:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0dfdcc9934068e5000d8b906423558878e7cd1b9a6b7b1d566a30a6f969ee71f

Request headers

Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:43:26 GMT
via: 1.1 bb45d9db269295920003af6514d7e7eb.cloudfront.net (CloudFront)
last-modified: Mon, 26 Nov 2018 13:16:08 GMT
server: nginx
age: 277
etag: "5bfbf218-4653"
x-cache: Hit from cloudfront
content-type: image/gif
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-length: 18003
x-amz-cf-id: KYx9ndC6oTeq6o53_pxH-hi6ymN765SF5SDHesvF7wxU9aQ8a3oGQg==

Redirect headers

date: Mon, 31 May 2021 05:45:51 GMT
server: nginx
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
location: https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
cache-control: no-cache, must-revalidate
content-type: text/html; charset=utf-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
static.tradetracker.net/nl/material_image/49/ Frame ED88
Redirect Chain

https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=16167500031559200719608011611016&t=html
https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg

13 KB
13 KB

24ms
15ms

Image
image/jpeg

2600:9000:2182:800:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=16167500031559200719608011611016&a=80a24ce5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:800:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 6d731e6d3e38558377e2fa974639cabf5209d9cafa5f00e186b0e3faf0aea02b

Request headers

Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
via: 1.1 bb45d9db269295920003af6514d7e7eb.cloudfront.net (CloudFront)
last-modified: Thu, 16 Mar 2017 08:27:46 GMT
server: nginx
x-amz-cf-pop: DUS51-C1
etag: "58ca4c82-335a"
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 13146
x-amz-cf-id: AgT0-jcokw2Bk8QmwsiMy9NeKqR2azOEjhAFqSroMErCo6ohR-R4lA==

Redirect headers

date: Mon, 31 May 2021 05:45:51 GMT
server: nginx
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
location: https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
cache-control: no-cache, must-revalidate
content-type: text/html; charset=utf-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal90006.redintelligence.net/ Frame 3ADD 0
150 B 102ms
34ms Script
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/viewability?s=25646200030154900719608011611006&a=06cb071b&vb=m
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=25646200030154900719608011611006&a=510c5bc8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal90006.redintelligence.net/request_content.php?s=25646200030154900719608011611006&a=510c5bc8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:51 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 3ADD 434 B
834 B 70ms
69ms Script
text/javascript 34.246.49.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=25646200030154900719608011611006&t=js&wid=tt-5a19fc
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=25646200030154900719608011611006&a=510c5bc8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.49.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-49-61.eu-west-1.compute.amazonaws.com
Software: nginx / PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
Resource Hash: 816e154c49a9e9d952fe14270bd6466e8cb9122edd121fc68a7626a1b25c74d6

Request headers

Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=utf8
server: nginx
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 3ADD 457 B
857 B 71ms
71ms Script
text/javascript 34.246.49.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=&r=25646200030154900719608011611006&t=js&wid=tt-216438
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=25646200030154900719608011611006&a=510c5bc8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.49.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-49-61.eu-west-1.compute.amazonaws.com
Software: nginx / PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
Resource Hash: a883828aa1e6ebdafdfbab2b4a33b31dbbd34a88014cabd32ee40170a4acac48

Request headers

Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=utf8
server: nginx
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29 200 activeview
pagead2.googlesyndication.com/pcs/ Frame DD90 42 B
64 B 40ms
40ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssZzgcrcIuyf96XBpQaRS5JUxSE91z9o08ERFggJZ_UbUIUP_OXTAms6t7PyN_6DxkShCciA7KM1PW4jBSptyOqOEfGaUhaW-O-dUDOWhdlnbqwLEdwZnrC7zmG4Q&sai=AMfl-YRINSaZrF9riLz3LY3GzUiQVxG-L1uo4er9OpcT1APAjuMqVGUTmNNcg6AqO_J7TusMXDrX7VzzV9kF6oRFNb-lxjj-2U26HftzRXn2OSMyZXFEE1qcAfa8XpUi6Gu3&sig=Cg0ArKJSzKwPG39zz_Y-EAE&id=ampim&o=315,37&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1002&mtos=0,0,0,1002,1002&tos=0,0,0,1002,0&tfs=262&tls=1264&g=99.83749985694885&h=99.83749985694885&tt=1264&r=v&avms=ampa&adk=4168856661

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 6F98 42 B
64 B 40ms
40ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvxEiJRXrQrmEN0IcWXcul9LqD3DWMiWRJhCp9CJGBU52aykWIxr9OD5dAH27LPfDD1l0JxpgSoRucl5Mnyxz4dKUABegCkupRgYW0A7ge8CPkNzvePC8aOM5ufAA&sai=AMfl-YTMMqQpFMIkWySg8ZNwm0tlYzT2K9gLHw0wjW1DU9GBM8J5Ijr1CzZc9tfTMwI71d12y7sgEc7C0uhdGjPbrQx2_7_Cc4_fTjpft1FNqHIwL27lBx5nI415j5KIgUFO&sig=Cg0ArKJSzGrUcQcqKFJAEAE&id=ampim&o=1150,505&d=160,600&ss=1600,1200&bs=1600,1200&mcvt=1005&mtos=0,0,1005,1005,1005&tos=0,0,1005,0,0&tfs=241&tls=1246&g=100&h=100&tt=1246&r=v&avms=ampa&adk=473129356

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 4C5D 4 KB
648 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=93147700025802000719608011611017&a=2b20bbd4

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

932060b34fe451f1cb994f3da257f6d2d0f281e1e286e9f3f0e2da63e862fec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 31 May 2021 05:31:09 GMT
server: ESF
date: Mon, 31 May 2021 05:45:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 31 May 2021 05:45:51 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4C5D 12 KB
12 KB 92ms
31ms Image
image/png 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/53619/creativesup/img220807_banners_megekko_affiliate_image_v2-1597759923086-min%20(2).jpg
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=93147700025802000719608011611017&a=2b20bbd4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 4b8f09fa5fbd09ce9bf53c4b4cd77c34637343c31421ce7941cc408e36f4b6ea

Request headers

Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:51 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 11776
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal900017.redintelligence.net/ Frame 4C5D 0
150 B 89ms
30ms Script
text/html 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/viewability?s=93147700025802000719608011611017&a=c3ac54ed&vb=m
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=93147700025802000719608011611017&a=2b20bbd4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal900017.redintelligence.net/request_content.php?s=93147700025802000719608011611017&a=2b20bbd4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 31 May 2021 05:45:51 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 4C5D 434 B
834 B 65ms
65ms Script
text/javascript 34.246.49.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=93147700025802000719608011611017&t=js&wid=tt-5bb53c
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=93147700025802000719608011611017&a=2b20bbd4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.49.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-49-61.eu-west-1.compute.amazonaws.com
Software: nginx / PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
Resource Hash: 5bc2292037499137061223672a6af6afe844d1f735eeb19804362ef7eb44e9d7

Request headers

Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=utf8
server: nginx
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 4C5D 456 B
856 B 64ms
64ms Script
text/javascript 34.246.49.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=&r=93147700025802000719608011611017&t=js&wid=tt-3d143
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=93147700025802000719608011611017&a=2b20bbd4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.49.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-49-61.eu-west-1.compute.amazonaws.com
Software: nginx / PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
Resource Hash: f92498beee6757972e1fb1700f375f82e57a6ce001bda8aa9db82c51338d5640

Request headers

Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=utf8
server: nginx
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
static.tradetracker.net/nl/material_image/49/ Frame 3ADD
Redirect Chain

https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=25646200030154900719608011611006&t=html
https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg

13 KB
13 KB

10ms
10ms

Image
image/jpeg

2600:9000:2182:800:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=25646200030154900719608011611006&a=510c5bc8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:800:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 6d731e6d3e38558377e2fa974639cabf5209d9cafa5f00e186b0e3faf0aea02b

Request headers

Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
via: 1.1 bb45d9db269295920003af6514d7e7eb.cloudfront.net (CloudFront)
last-modified: Thu, 16 Mar 2017 08:27:46 GMT
server: nginx
x-amz-cf-pop: DUS51-C1
etag: "58ca4c82-335a"
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 13146
x-amz-cf-id: JN6pX-B3-biWGbrwTCpbTTqQM2IUukHcJUCN39NjoIMP1Bay8K1WmA==

Redirect headers

date: Mon, 31 May 2021 05:45:51 GMT
server: nginx
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
location: https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
cache-control: no-cache, must-revalidate
content-type: text/html; charset=utf-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
static.tradetracker.net/nl/material_image/6b/ Frame 3ADD
Redirect Chain

https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=25646200030154900719608011611006&t=html
https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif

18 KB
18 KB

9ms
9ms

Image
image/gif

2600:9000:2182:800:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=25646200030154900719608011611006&a=510c5bc8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:800:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0dfdcc9934068e5000d8b906423558878e7cd1b9a6b7b1d566a30a6f969ee71f

Request headers

Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:43:26 GMT
via: 1.1 bb45d9db269295920003af6514d7e7eb.cloudfront.net (CloudFront)
last-modified: Mon, 26 Nov 2018 13:16:08 GMT
server: nginx
age: 277
etag: "5bfbf218-4653"
x-cache: Hit from cloudfront
content-type: image/gif
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-length: 18003
x-amz-cf-id: 54hoFJNiU9r7js09S8nfARBXqzAPOPi2x0Q-ppkn1gev_yrQTZURBw==

Redirect headers

date: Mon, 31 May 2021 05:45:51 GMT
server: nginx
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
location: https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
cache-control: no-cache, must-revalidate
content-type: text/html; charset=utf-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
static.tradetracker.net/nl/material_image/6b/ Frame 4C5D
Redirect Chain

https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=93147700025802000719608011611017&t=html
https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif

18 KB
18 KB

11ms
10ms

Image
image/gif

2600:9000:2182:800:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=93147700025802000719608011611017&a=2b20bbd4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:800:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0dfdcc9934068e5000d8b906423558878e7cd1b9a6b7b1d566a30a6f969ee71f

Request headers

Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:43:26 GMT
via: 1.1 bb45d9db269295920003af6514d7e7eb.cloudfront.net (CloudFront)
last-modified: Mon, 26 Nov 2018 13:16:08 GMT
server: nginx
age: 277
etag: "5bfbf218-4653"
x-cache: Hit from cloudfront
content-type: image/gif
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-length: 18003
x-amz-cf-id: rcHafAdqNV5YWoqbZvyQ42FzDxzzCwfnorIabJHrwZLkG3pAyaTLXA==

Redirect headers

date: Mon, 31 May 2021 05:45:51 GMT
server: nginx
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
location: https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
cache-control: no-cache, must-revalidate
content-type: text/html; charset=utf-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
static.tradetracker.net/nl/material_image/49/ Frame 4C5D
Redirect Chain

https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=93147700025802000719608011611017&t=html
https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg

13 KB
13 KB

9ms
9ms

Image
image/jpeg

2600:9000:2182:800:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=93147700025802000719608011611017&a=2b20bbd4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:800:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 6d731e6d3e38558377e2fa974639cabf5209d9cafa5f00e186b0e3faf0aea02b

Request headers

Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 05:45:51 GMT
via: 1.1 bb45d9db269295920003af6514d7e7eb.cloudfront.net (CloudFront)
last-modified: Thu, 16 Mar 2017 08:27:46 GMT
server: nginx
age: 0
etag: "58ca4c82-335a"
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-length: 13146
x-amz-cf-id: j7PmmXvEB3BSLvc2-gEf4qD8Pvquok6rtQdV9O8JMfy3_91lkf99bQ==

Redirect headers

date: Mon, 31 May 2021 05:45:51 GMT
server: nginx
x-powered-by: PHP/7.1.33-24+ubuntu18.04.1+deb.sury.org+1
p3p: CP="ALL PUR DSP CUR ADMi DEVi CONi OUR COR IND", policyref="https://ti.tradetracker.net/public/w3c/p3p.xml"
location: https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
cache-control: no-cache, must-revalidate
content-type: text/html; charset=utf-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A74B 42 B
64 B 41ms
39ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvlQ_8B36wmI6nBwFY-W3tOaiP181yzEgftXlaHds7ZHEMYblvnWqnjVv9kLpSwSD_AjCE5bSIF-horbNwEHzXRfLFX0PExV2_GBjtMq6A&sig=Cg0ArKJSzMqgrNYlFwFQEAE&id=lidar2&mcvt=1000&p=67,986,167,1306&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210526&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=1981791554&rs=4&met=ie&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ%3D%3D&vs=4&eosm=0&rst=1622439950115&dlt=0&rpt=298&isd=0&msd=0&r=v&fum=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.manicapost.co.zw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6.gif
p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i1-v6exp3.ds.metric.gstatic.com/v6exp3/ Frame 13D9 35 B
410 B 59ms
14ms Image
image/gif 2a00:1450:4001:803::2012
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i1-v6exp3.ds.metric.gstatic.com/v6exp3/6.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2012 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:59 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6.gif
p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i2-v6exp3.v4.metric.gstatic.com/v6exp3/ Frame 13D9 35 B
410 B 107ms
29ms Image
image/gif 142.250.185.210
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i2-v6exp3.v4.metric.gstatic.com/v6exp3/6.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.210 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f18.1e100.net

Software

sffe /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 May 2021 05:45:59 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

99 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.manicapost.co.zw/wp-content/themes/sirius/js/sirius.min.js(Line 1) Message: sidebar height/count @ WINDOW-load - 5063.81/4
console-api	log	URL: https://www.manicapost.co.zw/wp-content/themes/sirius/js/sirius.min.js(Line 1) Message: sidebar height/count @ DOM-load - 5063.81/4
console-api	log	(Line 8) Message: 970 loaded
console-api	info	URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs(Line 10) Message: Powered by AMP ⚡ HTML – Version 2104130153000 https://www.manicapost.co.zw/
console-api	info	URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs(Line 10) Message: Powered by AMP ⚡ HTML – Version 2104130153000 https://www.manicapost.co.zw/
console-api	info	URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs(Line 10) Message: Powered by AMP ⚡ HTML – Version 2104130153000 https://www.manicapost.co.zw/
console-api	info	URL: https://cdn.ampproject.org/rtv/012104130153000/amp4ads-v0.mjs(Line 10) Message: Powered by AMP ⚡ HTML – Version 2104130153000 https://www.manicapost.co.zw/

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.yahoo.com
adservice.google.com
adservice.google.de
ajax.cloudflare.com
cdn.ampproject.org
cm.g.doubleclick.net
d847dc2f00f409661713f64c1b920f3a.safeframe.googlesyndication.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hal9000.redintelligence.net
hal900016.redintelligence.net
hal900017.redintelligence.net
hal90006.redintelligence.net
ib.adnxs.com
manicapost.co.zw
manicapost.zimpapersnetwork.co.zw
p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i1-v6exp3.ds.metric.gstatic.com
p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-640226-i2-v6exp3.v4.metric.gstatic.com
p4-b3hjoah67v5ca-2cmeg3rjmnk5nhay-if-v6exp3-v4.metric.gstatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
securepubads.g.doubleclick.net
static.doubleclick.net
static.tradetracker.net
sync.search.spotxchange.com
sync.teads.tv
the-manica-post.disqus.com
ti.tradetracker.net
tpc.googlesyndication.com
us-u.openx.net
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.manicapost.co.zw
www.youtube.com
104.111.242.245
138.201.220.30
138.201.63.164
138.201.64.38
142.250.180.195
142.250.185.210
151.101.112.134
159.69.70.9
172.217.18.98
185.33.220.243
185.94.180.125
2.18.234.21
216.58.212.162
2600:9000:2182:800:1a:7c92:efc0:93a1
2606:4700:20::681a:534
2606:4700:20::ac43:481a
2606:4700::6810:a823
2a00:1288:80:800::7000
2a00:1450:4001:801::2002
2a00:1450:4001:802::2002
2a00:1450:4001:803::200a
2a00:1450:4001:803::2012
2a00:1450:4001:809::2001
2a00:1450:4001:809::2003
2a00:1450:4001:809::2004
2a00:1450:4001:809::200e
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::2006
2a00:1450:4001:810::2008
2a00:1450:4001:811::2003
2a00:1450:4001:813::2001
2a00:1450:4001:813::2002
2a00:1450:4001:827::2004
2a00:1450:4001:827::200e
2a00:1450:4001:829::2003
2a00:1450:4001:82a::2002
2a00:1450:4001:82f::2002
2a00:1450:4001:831::2001
2a00:1450:4001:831::200a
2a00:1450:4001:831::200e
34.246.49.61
34.98.64.218
002017ec0f0edde493c861948f440284209eedb37dc0933bf85f4c16d96f55fe
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
03f14357b2de695aa54c32f6aa655da2e30c383035c0cead7234c80517f7740b
062fc1ec27743765f8fe8ea17b7aa2f5c4cb440bb15c2c6cc4b384a140a34bee
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bd0b5d8e455450424584dfdc8d35761342f797305b4cdc772f7fe78a72da284
0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
0dfdcc9934068e5000d8b906423558878e7cd1b9a6b7b1d566a30a6f969ee71f
0e579163c07bcfb29549653490b1adcb231db63cf75e349445b87857746963a5
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
11204abca2bebfba977f8d457cb0aa9a207167cebdb878f6177f26ef9cbc239f
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1518f05598970997d55127b09b77a4b3e5e5fbdb080b993ef03140f404489e17
168850c920ff331bd5d294b1a84972f74fa847bc89fd7a2d70b5e1480d2728c2
16ba4d835e9b44c688b2a7b7ae400bab62db6eb945f836bd7ff3a20df39cb4ff
16be77b01cf84090ac9788dc760f450c79375fcd9a4e72784fc6ce50160e8434
17728cc9705dbac47eefce9b0573f0c902952ca76e0f1da2cf5cf7bedd9eb90b
178f3d1421cd3d41c37445c258992b6299cb88f732c08ba2524ed06332c9f61f
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1bc5157ca01888a7eb616c51664571264c25faea44718b2b90e961a85fb081fa
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
1dad6cb9a0903898a8f82f89c0d10ee6e94f8459228530fa5df3078100c9f650
1e380b0d6dd9d28f1749c454601fcf8c23c91f381b027b9a98719ceb964d85ce
1e45ca14bc59eff23fa77a56b5a047910b4bb21832fb69ef9308c3e16caabbe4
1fe56e688ca09d9be11870763d7770e14eafd5d1117cd787fcaf4719d17727d2
21061765237c66c10b48e236063a3497c22d33629e98f8654d1a3b860fa48700
24c45402a6bdca80e9fad73f60536dd27ec52bc3bb9e2b751e1d3f92d91d9c62
26eaf5f6865956e4e726318f9891001f9870e4cd0b8469cd2673f89bbcfed690
2826f9525d9ff7b1d86065eb761da940e70856e239875b04e0e67a7c0edf3d4d
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2e515f6e09f5e26caff10460e9a027e236ec78caffaa756799730b20f4d33320
2e798946b8810df00972e68db2f30a553841075a3e9d1672f41de80e711e0876
30a4f0720eb817be3b00a15a067ea8aacd09a129471120efacb038fd90baf746
318d8bd7b35d023bb4987aab6dfc52500e840677619ba79e413e1c3981ee4254
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
34dee9e8aff2d559516be5101700234798d955c65924b5a45ebcfefded7ab8bc
3533d60766873bc3d2762dbe1cf95bde477875a1c84e5713bd0fb55763ba6028
35dfa46c308e2121eb39b0ebc575c737aa2c38c84ecca012ef197ee594bc3865
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
371f9015d3e8020505b1d38b78289b9c3cd15ccd16490e49df4d401983a96144
3a0436261ea4a2e3414288b2e581316a4eee4139729d62968ce326860938c7a4
3a5d4285755fd0b31ba04888752b18cc11549cd896def034a6e1e112bd240dd1
3a73ec91499eb126d6264a7980c9cfa90de61123aac408b796db38192db91a1c
3b0d832cc038aa61ee3d925ff03d0dd6456e74707619ffdb5b467442c3d0484b
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3f032dca5ec03847710c3980a7aa116553d73308002235649cf4f63536efa7f7
431109939c869edef966caefbc34cb613c3236c74bcd80b3caf5e2d46607bf09
48118c47e648dbdfd10111a10c110304eef6c5fcbc0019f4e4f3672747f5dc0a
4a865f50ddfaabd99f5006d3d1ac0970bb4a3787da131ada7818c300cd5083f2
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b8f09fa5fbd09ce9bf53c4b4cd77c34637343c31421ce7941cc408e36f4b6ea
4ca751259d4d082cb1074ce854f88c4d530727eef1c78860528ffbe0acfc63f3
4cc755a99349527933df50f5338a02d972da947a4c25f4a5309f4545ddc40ee1
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e75415b3b5788ade9494857346087b15db3f7cd27f0c404267a5b3b8630a001
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50eeeac8e79f59f5775da352f650d0de7def7c3cff6e7d48c94b923eece0e27b
510fa6edd1c44740a6496b2be796e5846ab6ff3a3406378e83b2888c62ff2a62
5208aece8c5754bc7df7cd74c2f7fc691b608dde785129405ea007cc6e9d7d18
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
559887ee3ed9c6647e83bca9be99f2a8fc4586d11457dd96231259a5c09d5eb2
5752d4a50658cddeceb586dccb5713bb9cf91efc2976d79f2a47248c010f192e
57dd85466749e869c5958a2652e548673557a2390ec68490a353916353ecc74e
583eda12fed77c078f7391866e53eedd80aec5b9b178a3537a3c4c3b09575485
588d5d74a99b8f56a6a93c34ee1376d1c71d87888c21ec3a21cdc192a1bd3a70
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
5bc2292037499137061223672a6af6afe844d1f735eeb19804362ef7eb44e9d7
5c0f141124c26f9d289be3679ff3d997f802fb5c6ee9088477381f48ba9a3a07
5cfd937ed1b27066b87c8094ab74379f47391e00f74876aee67729dbf3d9dd22
5d11bfaf0ec10d9aa65518e0c8c4a3cfe3d7bb6a5cbac94d48ba54921d18b858
5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f
5f5b7b08513fceb4aae39b62d9429ae696cec9a67d2fcf09b614fb664c4bd8c4
5f87757a436d46db2cc03fa7901b5bbdfb2bde93b05c16ef99d046d29e643159
5fbc5ee88afc9f9b2aac88a6b37f0f3b112ca732380142b09b0ae13feb4f7d31
637db90a032f52478a681e2d23ef6435d81107bbcf6b6f827912bba541783368
643dac8ae374ed0852585b2459c25f1894ba8b4a2578d0a67d8f3c786c5d4811
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
684722f2ec67f3a1b4aad3b445dd37b60d048d66701dfff1f5c40b3bad4fae8a
68bdfa8f9127be3622b9fc437a0a0173855fc86a7245d0f322af2b479294d198
6a88a65aaa5cf0915453542b49ee678f052f32fa03e50c0f0becb66127e79540
6aa7181afe0bea9dc4e90e1d040c0b27be388088f6a5ec3d195c60229fe3c9b5
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c2b6a232a2b5de7d044e27d3ec8ebd644b2ead821a8cf13f9da01b04b5b1d9b
6d55959f187cdb47ac1422c6191b303c98552de1aa114e250b87c0b0444705fb
6d731e6d3e38558377e2fa974639cabf5209d9cafa5f00e186b0e3faf0aea02b
6dcb5c723a611485bc2f009b6a534d263a9186d21d62e5d0eccdd56b8929c93b
7293ed82c0d8a87f8c60dcb6598ff06270b2bf370adc318099a17d2d430d556d
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
73ea11b415ced029d8200d0f08035d8be4a3dcf2888da1e20ed0c5ccbde47d7a
746f5c9128d286367df2610b35f95de047b40692a5a37a668ac7204af416ec6b
7bc29500273c93c58829591b68df2cd5b8885409f82654d852b5b9b65d18f7be
7c197a45dc8134b5c126b809a77418d054366de3d18a16ed5733ab7c39c1d8f7
7d28ee8b4225eb077cb9d4d7152b064fc1a3820ea25b6d5c85e9157786206745
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
816e154c49a9e9d952fe14270bd6466e8cb9122edd121fc68a7626a1b25c74d6
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8371cb46be63803cefac1c7cefb83787810907a2ea9e03a33041251e44cdc0cb
842c872b3898f5b0e7d31292eebc5442195611e262f59bae3e7d5b63c507e00d
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
872fdbf1d445fc24148a4025a848e9c9e7eee31730e98fc218f58b13d28461da
8883a14e28c43192e52a115f6abc8f72909088d49d13752a913816614c984a31
8aea8bef75321784eb5d9250f53130d6aceb4c04aa683f93e4928fc4c9e5f181
8d7401bef80e31a1aa3a2d1daab189dfba7f02a21e7cfef216e011f0c05a74da
8e40130ad817f54b4dff6c42ae6f64dce1f2abdb307fe5e6fa8bd0ef1f6c1b2e
8f359cea41f7e97a585f44c7c318c4f2314b2981060da1623e39d8d348ff9150
9128b1d7f7b52515a897d69d304f9685ed3634757cb2f8fa149dfbb54352b991
91d5aee8f0faa85b2ea0c29a0ade99e67256834feed8fd87fb801461061d874c
92b778b8b56563a4e60c822029684463fb210736470e6233ad2cb34221b655df
932060b34fe451f1cb994f3da257f6d2d0f281e1e286e9f3f0e2da63e862fec6
94170b47dff76034358f283ac264b75627044a2e85fd320e008e1d2e64e76ae8
941c473a662a1536d549296a33a95be32cd338f8e9564b053ae19d201f9f2791
949bf41ee705bcc14a5ac211f1739a2f7a593e9fdc00758d537502854dacdb80
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a0ce0bf6b6fad9977a41544413cd910987a7bc24289d4b936c5a6281782cde33
a1db8f0f4bf4b81f40329546eb98a57430613cf9252e900ddd1b0dcdfa7a22c2
a2836991c49b40f0104e7f29465d3270f143b33a05632131801767a67cab20bc
a42adfeac5d15f6f2bfee7dbcfb996cc98bc479152aecbe135b18c5696176d95
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a656137c96d7c5550298220b3583603d6342a582bb53251bdcc52dace3716d4b
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a82269bce61196e0aca1c36b304de3471e367a41179284996e6b06b2a3b3009a
a883828aa1e6ebdafdfbab2b4a33b31dbbd34a88014cabd32ee40170a4acac48
ab93c4304ded96166e02e7ef20fa37d04a4526c7e8591589ce930087a752d797
abacfa18472a4ace0034615d9219c5d3585292b5920881c434f7a3382f7cfc57
ad2f5c724e0241954f4afc791a93b3dd57852550bcd4c78cbf755e608b0015d0
ad626d252ee16740043cb344578997791505552c1d006411aba5b6bd55ea9aef
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1f8ddab278293c9f219cc4f4a92b7a8391b3029e53aaba6bb10c4638bac1770
b31995cb054e2340132dcf4d5740eed33295786d075c689641e1cf82b026c283
b501be064399eb54a71980273ffb3966fa51e9979b45420e24774be52954e6c6
b6a368d36866863dcccbd259abd44ed9544c906d6eae088f743fe083afb38e17
b6d39508164d7015990a918eb8f035aa7040f943a834f028f843046855991fcd
bb731be92c4bfe2360141c42a987ee49e2191ed75e2efff0dcc42e1882d6da7b
bb759faf67697ba0b5359e9574f85b1fe60574b6d96fce3df6eaf102501b107c
bcf6d819952543d324bec7fd2b2ba9bd9c08548bef8c0eb272e5fd24d1080904
bd0246d176a8e007808c21b7438fc496e62ccbd28f30c1d09359fed66ad8bf95
be42ad9dda1b210eba319a24037d4c6e1d509b09b888c4cae1b575c77f0848f5
c3d84be67c0c5be9cfca5550b4bcc0947d40d62806652b81f7c296bfbc427357
c42b6e05139583e046ae36bb3c4a5468b5bd28da2de146f2c7df9ae82babf3d5
c5537b8e22d98409891207b8fcdc960a93ac332726529bc8b49a0d161354c0aa
c56448b45d965391ebec4b7c6c4230650932dad5ae7acbcb321060c1a374360c
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
c662d3bff7289b3288aa26686a683958747bf2e2e14b3623127da094cc70bcac
c71387ab708c1c8e4f7d83aff28378dc95f6864d6c99a9118ce32d16ee4865a4
c9b6d7609b11db82da8775c91e21fae0ae18a64123cbb6f9cabf7b412bf8b1a3
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cc8995800462e967657ce7a6d242f5226c5e0bdb2ca9e9947f238078b7566bce
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
ccf9f06e011a933f85a99067952719fbeec992c04d89dd1c2b40763a0bc5812b
cde74d28de3cfa3e76df590e6d952450621bf0934cd7ceaa4501404680fc61f9
d0db25ef51be4da97c1c3039bc99b071777499088e6b4d4902350f92c9d99075
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d2fb6f79d7a4ab0226ce9634cc960a4430c488459219c956d350868b39f20783
d336cb925fcfdf4ba8d70c944d8b5ccfe30515f456ae06f58044cd5bfe261838
d563ab5c6b46551718ad9ee5ef1ae828c64c2f9c7fb697f19fc7526566c9890a
d5b5fab3b788b3161871e2509cbaaa55f9b73fae0aae0459211269320f11ab5a
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d70519c813d7ba3385be6e3b5b62483985d4e62be9dde3f1555cac8b9a1c80c1
d7139c86828ab90555f59fbccbf0209ed8da1f5498ba5d78f80c3b189f38e705
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
d915c1a38320682d4c8e6fbe119889d26a91958f472d10808c161f938fc14957
daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f
dbaeed6f465ecf572dfc8d9266cb803b2629c8c726d38e87d271f1c2f64aeed9
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
de847f008cefaa0af3f0dc06ff01fac03477faa591c75c9f1f8ddac42b23d8b5
df356f8aa91e7f14dc79f22056218dddc3b711545e6d5d2d1e72eaa17b052f1f
e1779cc27bcf139f9fd17807dc18a301e289a7bf52b8afece2457a01efb3c63e
e19e5fec549d0d871301c8196f4a954abe8d6913464a1ac511f81ef71529f89b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e5c9da4ee2b652cd6cb34229147697def38f5cb79b9533b4a45daaef88af25
e4ea481478fd717638f959064b535f8a86209ee418b3ff5715f23ff9756da6e6
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5cd7b3a4c5496d4c699526a6882f4a609682c49ffe34462ac9be3304b97bb62
e8fcb3079cb44b316e0b00aa6e6f94f43b6f44cd1dc47a0f9ae7d9c0a57b3b5d
ea09650d614da1e0b7ab0bcfb61fb69e84e4bfce41f3a7e897db8858c7b1f842
ea94dab6f27afe7dd90d627ab632ad9f924ada429d50aaa9ee1b1e0cd7909c65
ec7d7284ec7a129ddae5b7c45781cc1ec89f267fb0d860771d3960db2161ff5f
ed67661232f5dc60bb2701492892a05c0c28027d52c4e1daf6f06179cf19d045
ed8fd5966c1d769a76d49fe6929becc99ca387a013c2bbed13165f9e5bfb315c
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1c146b484122d515e18d872c8c84038fa9c8fcbaa59a006b3f3022866d95c0f
f2b7c76c9afe8eedce734f7d8c524c475c403eef024cf1d4f2e3f92775ff5406
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
f33c9161b0be10c9e14d5fa71db400bb77bef2db4271127874b4fc0b70f57a99
f47f8034b4f08f1c4f05a6a914d7ba6fe966a0112d5ec0cbbae2cd7b35b6407b
f4cf42168880ed241a3e4c58cf7ae0ed789abbe0e5839bd0c3490409a3e7847b
f6ddd53004785a0c3ef56db4874a4d6d04540f5f4ba3ef94fc58533b8631f024
f7bba0cc484923e9dc8eb46a451efbd2ebe40980e07195777adaa39956bc5cd5
f92498beee6757972e1fb1700f375f82e57a6ce001bda8aa9db82c51338d5640
f9d8458e2ec4210b3ca49e6ea499c1eb919dad2a8e79a0cdc2ce5e39cc045dc4
fa7f92d274816a80d3fb8065565e8e4fc023eea6541e37bf4bb4acb198bcf9a1
fe82e851c99caf56c41e2b2228220475ec600ad8266b46b66d4c993b122ef363

www.manicapost.co.zw Open in urlscan Pro 2606:4700:20::681a:534 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

378 Requests

99 %HTTPS

64 %IPv6

24 Domains

39 Subdomains

43 IPs

5 Countries

4326 kBTransfer

10653 kBSize

0 Cookies

43 Outgoing links

Page URL History

Redirected requests

378 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.manicapost.co.zw Open in urlscan Pro
2606:4700:20::681a:534 Public Scan

Screenshot
Live screenshot

Full Image

378
Requests

99 %
HTTPS

64 %
IPv6

24
Domains

39
Subdomains

43
IPs

5
Countries

4326 kB
Transfer

10653 kB
Size

0
Cookies

378 HTTP transactions
7 data transactions