www.bg3.co Open in urlscan Pro
84.17.37.44 Public Scan

Software

sffe /

Resource Hash

1d06186935333e9e0054906d58a51794a743376d1b71dc55df78e65debcc9820

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Thu, 24 Nov 2022 07:06:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72561
x-xss-protection: 0
server: sffe
etag: "8982a451fc00c1b3"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3000, stale-while-revalidate=1206600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 24 Nov 2022 07:06:16 GMT

GET
H2 200 amp-sidebar-0.1.js Show response
cdn.ampproject.org/v0/ 31 KB
10 KB 1486ms
943ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-sidebar-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0535100df27c6d49a6d1c06b7f98455bf0cdef6ae63c4c168b5cf1f170c14c51

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Thu, 24 Nov 2022 07:06:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9664
x-xss-protection: 0
server: sffe
etag: "6079829c87823654"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 24 Nov 2022 07:06:16 GMT

GET
H2 200 amp-auto-ads-0.1.js Show response
cdn.ampproject.org/v0/ 24 KB
9 KB 790ms
271ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-auto-ads-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c71445ec9538a4d031b32ba0f044ae793aac625896846f838f9c8abace99c08

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Thu, 24 Nov 2022 07:06:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7578
x-xss-protection: 0
server: sffe
etag: "1ef491f2ce412f6e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 24 Nov 2022 07:06:16 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/v0/ 109 KB
31 KB 1348ms
830ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-analytics-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

878674d3e2986e2a0da06a414498ebe39c165c2e22624600ee179ec9df149105

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Thu, 24 Nov 2022 07:06:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31953
x-xss-protection: 0
server: sffe
etag: "eddf6e9f984d26cc"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 24 Nov 2022 07:06:16 GMT

GET
H2

200

sdk Show response
cdn.aralego.net/ucfad/sdk/apac-sg/
Redirect Chain

https://ads.aralego.com/sdk
https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk

44 KB
44 KB

468ms
170ms

Script
application/octet-stream

104.26.5.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Server: 104.26.5.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6703fbe9ea598731ec6ef75a281564d956ef79f08bc2b61849ae9a21fa35cb9

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3186
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44566
last-modified: Wed, 16 Nov 2022 08:39:32 GMT
server: cloudflare
etag: "6374a1c4-ae16"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oZaayCco%2FM63czb6d%2Flb0Re2hg8tbAz7gato1S4ciiJvXWFtf6zOzNfWDZwpFlOeRaHwjK%2FuWvAdrWeZZYPz2d96k%2FygBmeAee3qQAYOm4xGX%2F3OCyTj%2F5h%2Fins8nCC1LA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 76f04d1219d2a941-SYD

Redirect headers

location: https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk
connection: close
content-length: 0

GET
H2 200 adRecover.js Show response
delivery.adrecover.com/43519/ 34 KB
9 KB 1736ms
673ms Script
application/javascript 42.99.140.144
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivery.adrecover.com/43519/adRecover.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.144 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-144.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 91e8bd3a37b3a0951444714dc07c68417ac878ebf22d8c7b0d10b1ce3fec1122

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Thu, 24 Nov 2022 07:06:17 GMT
content-encoding: br
last-modified: Thu, 24 Nov 2022 07:00:35 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=109, origin; dur=204
x-cf-geodata: NZ
content-length: 9035
expires: Thu, 24 Nov 2022 08:06:17 GMT

GET
H2 200 adpushup.js Show response
cdn.adpushup.com/42753/ 518 KB
112 KB 1362ms
348ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/adpushup.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 6bfd228178a7920f79853de46df09c0a6ee732b6d92100be5bb99174d05a9c07

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Thu, 24 Nov 2022 07:06:17 GMT
content-encoding: br
last-modified: Thu, 17 Nov 2022 09:46:28 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
x-cf-geodata: NZ
content-length: 114452
expires: Thu, 24 Nov 2022 08:06:17 GMT

GET
H2 200 ucfad-formats.css
cdn.aralego.net/css/dev/ 975 B
615 B 153ms
152ms Stylesheet
text/css 104.26.5.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/css/dev/ucfad-formats.css
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.5.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1be00e223b2840fe8ac2d3a1aec0cf757088dd68f53a92275d0e1db6cb9afced

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5896
cf-polished: origSize=1191
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 16 Mar 2018 07:19:46 GMT
server: cloudflare
etag: W/"5aab7012-4a7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9GXOvjPcF1ss%2FoQD39a0CPHwNQgWgPMHsyaAHBtkFOn%2FOleYJUun20J0jtQG45ZC4jhS23E1%2Bw7Mvuq9O1UOo5PdF1NcATCdRfKOMfItLVoIsl1lSOO7PQFtJKkF2mP81A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
access-control-allow-credentials: true
cf-ray: 76f04d141cdca941-SYD

GET
H/1.1 200
OK idRequest Show response
sync.aralego.com/ 46 B
488 B 1077ms
268ms XHR
text/html 64.120.88.131
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.aralego.com/idRequest?lang=en-US,en&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.120.88.131 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: 531ced95d00fc8c26a6140869fb583238b0ccf457b7bb9e98d42d6b8a29323d6

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 24 Nov 2022 07:06:18 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Allow-Credentials: true
Connection: close
Content-Length: 46

GET
H/1.1 200
OK idRequest Show response
sync.aralego.com/ 46 B
488 B 1065ms
268ms XHR
text/html 64.120.88.131
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.aralego.com/idRequest?lang=en-US,en&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.120.88.131 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: 531ced95d00fc8c26a6140869fb583238b0ccf457b7bb9e98d42d6b8a29323d6

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 24 Nov 2022 07:06:18 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Allow-Credentials: true
Connection: close
Content-Length: 46

GET
H/1.1 200
OK ad_request Show response
ads.aralego.com/ 508 B
1 KB 844ms
375ms XHR
text/html 23.108.102.145
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.aralego.com/ad_request?sw=1600&sh=1200&ifr=0&bl=en-US&je=1&dnt=0&host=www.bg3.co&u=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&adid=ad-627443DBE4283AB9F7A46EA83243447&w=336&h=280&ver=UCX_WEB-20200113&pos=1&seq=0&cb=0.9579232967437972&gdpr=1&euconsent-v2=%24%7BGDPR_CONSENT_607%7D&format=336%2C280%3B&lang=en-US%2Cen&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&uaMobile=%3F0
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.102.145 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: e813a8d8d41c0dbdc33020ad6ef27d16afd2b590ceeb998e267409c8f666b829

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:18 GMT
x-width: 336
x-height: 280
x-adstyle: banner
access-control-allow-methods: GET,POST,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: X-Width,X-Height,X-AdStyle,X-AdCap,X-AdWatchUrl,X-AdSource,X-SspId,X-Deal
vary: Accept-Encoding
access-control-allow-credentials: true
x-adsource: PSA
x-adtype: html
connection: close
content-length: 508

GET
H/1.1 200
OK ad_request Show response
ads.aralego.com/ 508 B
1 KB 784ms
314ms XHR
text/html 23.108.102.145
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.aralego.com/ad_request?sw=1600&sh=1200&ifr=0&bl=en-US&je=1&dnt=0&host=www.bg3.co&u=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&adid=ad-627443DBE4283AB9F7A46EA83243447&w=336&h=280&ver=UCX_WEB-20200113&pos=1&seq=1&cb=0.5779296613306302&gdpr=1&euconsent-v2=%24%7BGDPR_CONSENT_607%7D&format=336%2C280%3B&lang=en-US%2Cen&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&uaMobile=%3F0
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.102.145 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: e813a8d8d41c0dbdc33020ad6ef27d16afd2b590ceeb998e267409c8f666b829

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:18 GMT
x-width: 336
x-height: 280
x-adstyle: banner
access-control-allow-methods: GET,POST,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: X-Width,X-Height,X-AdStyle,X-AdCap,X-AdWatchUrl,X-AdSource,X-SspId,X-Deal
vary: Accept-Encoding
access-control-allow-credentials: true
x-adsource: PSA
x-adtype: html
connection: close
content-length: 508

GET
H2 403 32a3227a523db64ed17e16f31457df55.jpg
static.bg3.co/imgs/202106/ 0
0 458ms
161ms Image
text/html 104.26.3.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/32a3227a523db64ed17e16f31457df55.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 5cfde1bd6f765822e1ba23c36891de0f.jpg
static.bg3.co/imgs/202105/ 0
0 169ms
167ms Image
text/html 104.26.3.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/5cfde1bd6f765822e1ba23c36891de0f.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 07ee0d76d98bca5b83d735bf1ee8ebd4.jpg
static.bg3.co/imgs/202106/ 0
0 182ms
180ms Image
text/html 104.26.3.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/07ee0d76d98bca5b83d735bf1ee8ebd4.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 7b8d6af4d8dcfff527b18e5c7dec1cf3.jpg
static.bg3.co/imgs/202106/ 0
0 176ms
173ms Image
text/html 104.26.3.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/7b8d6af4d8dcfff527b18e5c7dec1cf3.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 4b1a089433a73554d3408f727b46beb5.jpg
static.bg3.co/imgs/202105/ 0
0 162ms
160ms Image
text/html 104.26.3.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/4b1a089433a73554d3408f727b46beb5.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 216a50623975616b930087d09cf13e0b.jpg
static.bg3.co/imgs/202105/ 0
0 186ms
183ms Image
text/html 104.26.3.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/216a50623975616b930087d09cf13e0b.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 28d7099a5e7f0ea3f7d4e224cf8095c5.jpg
static.bg3.co/imgs/202106/ 0
0 151ms
149ms Image
text/html 104.26.3.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/28d7099a5e7f0ea3f7d4e224cf8095c5.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 36b7dfb1fefd796d5dbe0bbe175e9089.gif
static.bg3.co/imgs/202107/ 0
0 156ms
154ms Image
text/html 104.26.3.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202107/36b7dfb1fefd796d5dbe0bbe175e9089.gif?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 amp-auto-lightbox-0.1.js Show response
cdn.ampproject.org/rtv/012211042305000/v0/ 8 KB
3 KB 898ms
349ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/amp-auto-lightbox-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9367980d1a2a729754c9a6777d7236e9d49c662a197f00e210ba276d7e0aa6ac

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 22 Nov 2022 20:06:17 GMT
age: 126002
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2991
x-xss-protection: 0
server: sffe
etag: "413d5b5eb26df1c9"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 22 Nov 2023 20:06:17 GMT

GET
H3 200 amp-ad-0.1.js Show response
cdn.ampproject.org/rtv/012211042305000/v0/ 81 KB
23 KB 824ms
275ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/amp-ad-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e005bd498c71a1e59de4a20aec621c9a51451e498778fb049957e17fca316f8c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 24 Nov 2022 00:15:08 GMT
age: 24671
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23066
x-xss-protection: 0
server: sffe
etag: "1b79e24071ca714c"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 24 Nov 2023 00:15:08 GMT

GET
H2 200 ama Show response
pagead2.googlesyndication.com/getconfig/ 3 KB
905 B 823ms
276ms Fetch
application/json 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/ama?client=ca-pub-3216231935713038&plah=www.bg3.co&ama_t=amp&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7960fa01b219284ff1f6ced310ad6aab5fcedb8b9cb470238d23b1f535ecbb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:18 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 464
x-xss-protection: 0

GET
H3 200 amp-loader-0.1.js Show response
cdn.ampproject.org/rtv/012211042305000/v0/ 12 KB
4 KB 919ms
370ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/amp-loader-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e76fa5f8f7b53855ef3a64bb458a6ff4a09da9a814e81d844c973008139f527

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 22 Nov 2022 20:06:01 GMT
age: 126018
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3936
x-xss-protection: 0
server: sffe
etag: "2e876f41249f1a45"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 22 Nov 2023 20:06:01 GMT

GET
H2 200 jquery-2.2.2.min.js Show response
code.jquery.com/ 84 KB
30 KB 840ms
277ms Script
application/javascript 69.16.175.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.2.min.js
Requested by: Host: delivery.adrecover.com
URL: https://delivery.adrecover.com/43519/adRecover.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: hwcdn.net
Software: nginx /
Resource Hash: dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:19 GMT
content-encoding: gzip
x-sp-metadata: HS256.CPvL/JsGEogBCiQ1ZGM0ODc5Ny01MGMwLTRmY2MtOTAwNi0yMmQwMjA1M2QzN2EQ6JCNkN3O+gIaBgjrr/ybBiINMTE2LjkwLjc0LjIwMijOkAIwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJDFiM2UxZDJjLWQxOGYtNDAyOS04ZWQzLTI4OWJmZGIxNjNmNxi46QE=.i/j0ozyyhxnc0EJmCvEDjWEg/mFOz6bCMPJXBY2PWXs=
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-14e98"
vary: Accept-Encoding
x-hw: 1669273579.dop029.la3.t,1669273579.cds232.la3.hn,1669273579.cds210.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29880

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
31 KB 1134ms
571ms Script
application/javascript 69.16.175.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: hwcdn.net
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:19 GMT
content-encoding: gzip
x-sp-metadata: HS256.CPvL/JsGEogBCiQ0YWI3Yzc5Ni05Yjk3LTRlMjYtYmVkZi0yOTg3NmZkMTdmZDUQ6JCNkN3O+gIaBgjrr/ybBiINMTE2LjkwLjc0LjIwMijOkAIwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJDY5OWZmYzQ3LTQ3ZjItNDc0MS04YWUyLTYzMGY3NjdlZmNkNxib8QE=.UvhuRalGyQtzrmF0VRh4ZHTrP1VjtGn08mtGJHLPsJw=
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15d9d"
vary: Accept-Encoding
x-hw: 1669273579.dop029.la3.t,1669273579.cds232.la3.hn,1669273579.cds267.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame FA9B 99 KB
34 KB 842ms
287ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: ads.aralego.com
URL: https://ads.aralego.com/sdk

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f0457ddcf9d19dcf40244ac7e893bddf452df8ebb23725be30b1171aaf3385a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34207
x-xss-protection: 0
server: cafe
etag: 10783366830370841726
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 07:06:19 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame B82B 99 KB
34 KB 1114ms
617ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: ads.aralego.com
URL: https://ads.aralego.com/sdk

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

badfa14d323f05f827036b9d5a12835fd3c3684af084a0c845e71ab432082073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34255
x-xss-protection: 0
server: cafe
etag: 5329660436107822625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 07:06:19 GMT

GET
H3 200 amp-sticky-ad-1.0.js Show response
cdn.ampproject.org/rtv/012211042305000/v0/ 40 KB
10 KB 737ms
291ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/amp-sticky-ad-1.0.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef61de62bdd4d685961d0da741d164c50e531c9d98376158e47bb777363970f6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 21 Nov 2022 16:13:29 GMT
age: 226370
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10255
x-xss-protection: 0
server: sffe
etag: "4d52d329cbd34968"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 21 Nov 2023 16:13:29 GMT

GET
H3 200 cookieSyncIframe.html Show response
cdn.aralego.net/ucfad/cookie/ Frame D2A4 714 B
794 B 152ms
151ms Document
text/html 104.26.5.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.5.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36a7d95f2760a813f3e782dfc125ea786174d581d6f6f896021d6994e9514bd6

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
age: 3103
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 76f04d1adb755509-SYD
content-encoding: br
content-type: text/html
date: Thu, 24 Nov 2022 07:06:18 GMT
last-modified: Wed, 09 Feb 2022 05:59:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gw6fFw7JOGtgcas1j2gDyakr005V%2B6mEnJy9LIvmDAPMNq3oHlxSDc9w9RfhwWPLbnWVVniXWF6tVNDv3lZ8qCQ%2BipTv%2BjY6DchtpH28oxsOno30R01ihcOldu4oZ4PMag%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK idsync
sync.aralego.com/ 35 B
384 B 267ms
267ms Image
image/gif 64.120.88.131
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.aralego.com/idsync?gdpr=1&euconsent-v2=${GDPR_CONSENT_607}&
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.120.88.131 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 24 Nov 2022 07:06:18 GMT
Connection: close
Content-Length: 35
Content-Type: image/gif

GET
H3 200 gtag.json Show response
cdn.ampproject.org/rtv/012211042305000/v0/analytics-vendors/ 2 KB
931 B 588ms
283ms Fetch
application/json 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/analytics-vendors/gtag.json

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8993772c9eb591474f38d257bebc8c4286703e1af72d04c8c294be5fff7b649

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 22 Nov 2022 20:10:34 GMT
age: 125745
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 901
x-xss-protection: 0
server: sffe
etag: "f8777e0f4a2af1a5"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 22 Nov 2023 20:10:34 GMT

GET
H3 200 cookieSyncIframe.html Show response
cdn.aralego.net/ucfad/cookie/ Frame 030D 714 B
764 B 151ms
151ms Document
text/html 104.26.5.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.5.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36a7d95f2760a813f3e782dfc125ea786174d581d6f6f896021d6994e9514bd6

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
age: 3103
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 76f04d1afb8d5509-SYD
content-encoding: br
content-type: text/html
date: Thu, 24 Nov 2022 07:06:18 GMT
last-modified: Wed, 09 Feb 2022 05:59:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BTrmVPmxZZ9P5%2FNHEi8gILjiapyGzu3T%2BPUTJrTjzR1YJZ3ZjddtAUO6Xw722ar6kwTvqYbsIZlD%2FxMilvNb0w4nFYWHHwBZs6C3NGrjUYDpQn35KoZakXBaF6kPYxuPdQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame D2A4 78 KB
27 KB 818ms
272ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.aralego.net
URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2789661e67642847c0582652469996d40ea33e2750544195743cf7e2532e4836

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27210
x-xss-protection: 0
server: sffe
etag: "1401 / 577 of 1000 / last-modified: 1669244741"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 24 Nov 2022 07:06:19 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 030D 78 KB
27 KB 1096ms
559ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.aralego.net
URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2789661e67642847c0582652469996d40ea33e2750544195743cf7e2532e4836

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27210
x-xss-protection: 0
server: sffe
etag: "1401 / 67 of 1000 / last-modified: 1669244741"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 24 Nov 2022 07:06:19 GMT

POST
H2 200 amp Show response
www.googletagmanager.com/gtag/ 610 B
808 B 824ms
277ms Fetch
application/json 142.250.4.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/amp?__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

8492f3fc13f89700f09e8a96308911979a6289be084af2c497ea54dbd7dd7f5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=utf-8

Response headers

date: Thu, 24 Nov 2022 07:06:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="amp.json"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 258
x-xss-protection: 0
pragma: no-cache
amp-access-control-allow-source-origin: https://www.bg3.co
server: Google Tag Manager
vary: *
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 amp-ad-network-adsense-impl-0.1.js Show response
cdn.ampproject.org/rtv/012211042305000/v0/ 214 KB
57 KB 276ms
275ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/amp-ad-network-adsense-impl-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a89c99a73b3c1f0c7a3977dd68ceba2286f13385d81aa1bf2c6811bce17f84fd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 22 Nov 2022 20:11:15 GMT
age: 125704
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57837
x-xss-protection: 0
server: sffe
etag: "23f3142da2c5be06"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 22 Nov 2023 20:11:15 GMT

GET
H2 200 block.jpg
delivery.adrecover.com/ 631 B
915 B 357ms
357ms Image
image/jpeg 42.99.140.144
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://delivery.adrecover.com/block.jpg?ts=1669273579518
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.144 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-144.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 9284d948e86d2e99f31483b5f4b3a4c3e65e0a6fbca9a8d2db8c6095f82ac3f5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Thu, 24 Nov 2022 07:06:19 GMT
last-modified: Wed, 23 Jun 2021 06:37:54 GMT
server: nginx/1.18.0
etag: "60d2d6c2-277"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=4
accept-ranges: bytes
content-length: 631
expires: Thu, 24 Nov 2022 08:06:19 GMT

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/ Frame FA9B 354 KB
117 KB 1540ms
1240ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_fy2021.js?bust=31070969

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1c451b030db960e68ef1831ca0db1485846d9a3c83b6ca54eadf49738ddd987d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119170
x-xss-protection: 0
server: cafe
etag: 18119870747237509758
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 07:06:20 GMT

GET
H2 200 pb.42753.1663912421366.js Show response
cdn.adpushup.com/prebid/ 342 KB
92 KB 1443ms
390ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 1c479d0abecadc8d5fde30eeb515508b6148fa3d92dd617b427788d6c792b0a8

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: br
last-modified: Fri, 23 Sep 2022 05:54:31 GMT
server: nginx/1.18.0
etag: W/"632d4a17-5578b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=3
content-length: 94168
expires: Fri, 24 Nov 2023 07:06:21 GMT

GET
H2 200 quantcast.js Show response
cdn.adpushup.com/pbuseridscripts/ 450 B
505 B 1374ms
355ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 26914004d3a8d5ddde2202b642d7936eb61c9f195b5cd3c87e44ef8ad4d57c16

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: br
last-modified: Mon, 28 Jun 2021 04:15:23 GMT
server: nginx/1.18.0
etag: W/"60d94cdb-1c2"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=3
content-length: 211
expires: Fri, 24 Nov 2023 07:06:21 GMT

GET
H2 200 linkPreview.js Show response
cdn.adpushup.com/42753/ 72 KB
17 KB 1384ms
366ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/linkPreview.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 968012b3a49390a10d31c6d36b2aab796ec167a83378b5f9787756ee7cb035c5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: br
last-modified: Thu, 14 Jul 2022 19:44:27 GMT
server: nginx/1.18.0
etag: W/"62d0721b-11ed1"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 17440
expires: Thu, 24 Nov 2022 08:06:21 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 78 KB
27 KB 573ms
272ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2789661e67642847c0582652469996d40ea33e2750544195743cf7e2532e4836

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27210
x-xss-protection: 0
server: sffe
etag: "1401 / 205 of 1000 / last-modified: 1669244741"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 24 Nov 2022 07:06:20 GMT

GET
H2 200 sync
e3.adpushup.com/AdPushupFeedbackWebService/user/ 70 B
539 B 721ms
234ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/user/sync
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:20 GMT
server: nginx/1.10.3 (Ubuntu)
ap-cookie-status: cookies ap_uid and ap_usid are set
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/ Frame B82B 355 KB
117 KB 486ms
296ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6348da6b652de2baefe437f72327f5bf10ed982630d4c0d092e627485169555d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119603
x-xss-protection: 0
server: cafe
etag: 14188585087142564408
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 07:06:20 GMT

GET
H2 200 pubads_impl_2022111501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame D2A4 381 KB
129 KB 577ms
276ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4c7748a8849068a7262049472b6b640aea77d843c16a57de3e34d3c47e4a01f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 12:10:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 154565
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132177
x-xss-protection: 0
last-modified: Tue, 15 Nov 2022 09:35:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 22 Nov 2023 12:10:15 GMT

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
317 B 626ms
240ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NjkyNzM1Nzk5MzYsInBhY2tldElkIjoiMDAwMEE3MDEtNWJkNTc2MWQtOTBlZi00MDE2LWFkMmQtNTA5M2VlMTcyOTA1Iiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2NoZW4tc2hpLXpob25nLXh1LXp1by16aS1qaS1saW5nLWh1bi16aHUtcmVuLWppYW5nLW1vLWFuLXhpYW5nLXhpbi16dWktemhvbmctZ3VhbmctbWluZy1rZS15aS16aGFuLXNoZW5nLWhlaS1hbi5odG1sIiwibW9kZSI6NCwiZXJyb3JDb2RlIjowLCJyZWZlcnJlciI6IiIsInBhZ2VHcm91cCI6IkFSVElDTEUiLCJwYWdlVmFyaWF0aW9uSWQiOiI5Njc1MDEyNS1iOTBjLTQ5N2EtODY5OS03MzE3MWY3YjQ5MzUiLCJwYWdlVmFyaWF0aW9uTmFtZSI6IkFkUHVzaHVwIiwicGFnZVZhcmlhdGlvblR5cGUiOjEsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOm51bGx9&c_b=5323.5
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:20 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
317 B 618ms
233ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NjkyNzM1Nzk5MzcsInBhY2tldElkIjoiMDAwMEE3MDEtNWJkNTc2MWQtOTBlZi00MDE2LWFkMmQtNTA5M2VlMTcyOTA1Iiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2NoZW4tc2hpLXpob25nLXh1LXp1by16aS1qaS1saW5nLWh1bi16aHUtcmVuLWppYW5nLW1vLWFuLXhpYW5nLXhpbi16dWktemhvbmctZ3VhbmctbWluZy1rZS15aS16aGFuLXNoZW5nLWhlaS1hbi5odG1sIiwibW9kZSI6NSwiZXJyb3JDb2RlIjoxLCJyZWZlcnJlciI6IiIsInBhZ2VHcm91cCI6IkFSVElDTEUiLCJwYWdlVmFyaWF0aW9uSWQiOiI5Njc1MDEyNS1iOTBjLTQ5N2EtODY5OS03MzE3MWY3YjQ5MzUiLCJwYWdlVmFyaWF0aW9uTmFtZSI6IkFkUHVzaHVwIiwicGFnZVZhcmlhdGlvblR5cGUiOjEsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOm51bGx9&c_b=5324.300000190735
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:20 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 625ms
241ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjkyNzM1Nzk5MzcsInBhY2tldElkIjoiMDAwMEE3MDEtNWJkNTc2MWQtOTBlZi00MDE2LWFkMmQtNTA5M2VlMTcyOTA1Iiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2NoZW4tc2hpLXpob25nLXh1LXp1by16aS1qaS1saW5nLWh1bi16aHUtcmVuLWppYW5nLW1vLWFuLXhpYW5nLXhpbi16dWktemhvbmctZ3VhbmctbWluZy1rZS15aS16aGFuLXNoZW5nLWhlaS1hbi5odG1sIiwibW9kZSI6MSwiZXJyb3JDb2RlIjoxLCJyZWZlcnJlciI6IiIsInBhZ2VHcm91cCI6IkFSVElDTEUiLCJwYWdlVmFyaWF0aW9uSWQiOiI5Njc1MDEyNS1iOTBjLTQ5N2EtODY5OS03MzE3MWY3YjQ5MzUiLCJwYWdlVmFyaWF0aW9uTmFtZSI6IkFkUHVzaHVwIiwicGFnZVZhcmlhdGlvblR5cGUiOjEsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOlt7InNlY3Rpb25JZCI6Ijc3YTljMjJmLWFjMDItNDVkZC05NmJjLWIwODk2YThhN2Q1YSIsInNlY3Rpb25OYW1lIjoiQVBfTF9EX0FSVElDTEVfNzI4WDI1MF83N2E5YyIsInN0YXR1cyI6MSwibmV0d29yayI6ImFkcFRhZ3MiLCJuZXR3b3JrQWRVbml0SWQiOiJBRFBfNDI3NTNfNzI4WDI1MF83N2E5YzIyZi1hYzAyLTQ1ZGQtOTZiYy1iMDg5NmE4YTdkNWEiLCJzZXJ2aWNlcyI6WzEsM10sImFkVW5pdFR5cGUiOjF9XX0%3D&c_b=5324.599999427795
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:20 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 adpushup-label.svg
campaign.adpushup.com/ads/ 8 KB
9 KB 592ms
142ms Image
image/svg+xml 152.199.39.108
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://campaign.adpushup.com/ads/adpushup-label.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7CA) /
Resource Hash: eb3577f46647f2e2db7307936038a47cc31c0ce75239496f6b7117282a47864c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:20 GMT
last-modified: Thu, 12 Nov 2020 09:18:18 GMT
server: ECAcc (nwa/E7CA)
age: 11791
etag: "5facfdda-21e0"
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=14400
accept-ranges: bytes
content-length: 8672
expires: Thu, 24 Nov 2022 11:06:20 GMT

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 619ms
240ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjkyNzM1Nzk5NDMsInBhY2tldElkIjoiMDAwMEE3MDEtNWJkNTc2MWQtOTBlZi00MDE2LWFkMmQtNTA5M2VlMTcyOTA1Iiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2NoZW4tc2hpLXpob25nLXh1LXp1by16aS1qaS1saW5nLWh1bi16aHUtcmVuLWppYW5nLW1vLWFuLXhpYW5nLXhpbi16dWktemhvbmctZ3VhbmctbWluZy1rZS15aS16aGFuLXNoZW5nLWhlaS1hbi5odG1sIiwibW9kZSI6MSwiZXJyb3JDb2RlIjoxLCJyZWZlcnJlciI6IiIsInBhZ2VHcm91cCI6IkFSVElDTEUiLCJwYWdlVmFyaWF0aW9uSWQiOiI5Njc1MDEyNS1iOTBjLTQ5N2EtODY5OS03MzE3MWY3YjQ5MzUiLCJwYWdlVmFyaWF0aW9uTmFtZSI6IkFkUHVzaHVwIiwicGFnZVZhcmlhdGlvblR5cGUiOjEsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOlt7InNlY3Rpb25JZCI6ImQxYzEwYTcyLTI3YjQtNDkzMS04Y2U3LTk5YTE4ZWJiZGJhZSIsInNlY3Rpb25OYW1lIjoiQVBfSV9EX0FSVElDTEVfNzI4WDkwX2QxYzEwIiwic3RhdHVzIjoxLCJuZXR3b3JrIjoiYWRwVGFncyIsIm5ldHdvcmtBZFVuaXRJZCI6IlNUSUNLWV9BRFBfNDI3NTNfNzI4WDkwX2QxYzEwYTcyLTI3YjQtNDkzMS04Y2U3LTk5YTE4ZWJiZGJhZSIsInNlcnZpY2VzIjpbNSwzXSwiYWRVbml0VHlwZSI6M31dfQ%3D%3D&c_b=5330.39999961853
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:20 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 613ms
236ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjkyNzM1Nzk5NDYsInBhY2tldElkIjoiMDAwMEE3MDEtNWJkNTc2MWQtOTBlZi00MDE2LWFkMmQtNTA5M2VlMTcyOTA1Iiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2NoZW4tc2hpLXpob25nLXh1LXp1by16aS1qaS1saW5nLWh1bi16aHUtcmVuLWppYW5nLW1vLWFuLXhpYW5nLXhpbi16dWktemhvbmctZ3VhbmctbWluZy1rZS15aS16aGFuLXNoZW5nLWhlaS1hbi5odG1sIiwibW9kZSI6MSwiZXJyb3JDb2RlIjoxLCJyZWZlcnJlciI6IiIsInBhZ2VHcm91cCI6IkFSVElDTEUiLCJwYWdlVmFyaWF0aW9uSWQiOiI5Njc1MDEyNS1iOTBjLTQ5N2EtODY5OS03MzE3MWY3YjQ5MzUiLCJwYWdlVmFyaWF0aW9uTmFtZSI6IkFkUHVzaHVwIiwicGFnZVZhcmlhdGlvblR5cGUiOjEsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOlt7InNlY3Rpb25JZCI6IjEwNGIyODJhLWJkMTEtNGQ4ZC1hZDY0LTA0OTIwNjNiNmNiYSIsInNlY3Rpb25OYW1lIjoiQVBfSV9EX0FSVElDTEVfMTIwWDYwMF8xMDRiMiIsInN0YXR1cyI6MSwibmV0d29yayI6ImFkcFRhZ3MiLCJuZXR3b3JrQWRVbml0SWQiOiJTVElDS1lfQURQXzQyNzUzXzEyMFg2MDBfMTA0YjI4MmEtYmQxMS00ZDhkLWFkNjQtMDQ5MjA2M2I2Y2JhIiwic2VydmljZXMiOls1LDNdLCJhZFVuaXRUeXBlIjozfV19&c_b=5333.599999427795
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:20 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 integrator.json Show response
adservice.google.com/adsid/ 86 B
572 B 831ms
277ms Fetch
application/json 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.json?domain=www.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

14cfb5058acaf3af2f07088f1582f29941d7a4cc74fd1cea5050cecad862d154

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83
x-xss-protection: 0

GET
H2 200 nameframe.html
d-4703894834014770347.ampproject.net/2211042305000/ 0
0 843ms
279ms Other
text/html 142.250.4.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d-4703894834014770347.ampproject.net/2211042305000/nameframe.html
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.4.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f94.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pubads_impl_2022111501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 030D 381 KB
129 KB 894ms
594ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4c7748a8849068a7262049472b6b640aea77d843c16a57de3e34d3c47e4a01f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 12:10:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 154565
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132177
x-xss-protection: 0
last-modified: Tue, 15 Nov 2022 09:35:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 22 Nov 2023 12:10:15 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
396 B 814ms
271ms Image
image/gif 172.217.194.138
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=a1&ds=AMP&aip&_s=1&dt=%E9%99%B3%E6%99%82%E4%B8%AD%E7%B1%B2%E3%80%8C%E5%81%9A%E8%87%AA%E5%B7%B1%E9%9D%88%E9%AD%82%E4%B8%BB%E4%BA%BA%E3%80%8D%E3%80%80%E8%94%A3%E8%90%AC%E5%AE%89%EF%BC%9A%E7%9B%B8%E4%BF%A1%E6%9C%80%E7%B5%82%E5%85%89%E6%98%8E%E5%8F%AF%E4%BB%A5%E6%88%B0%E5%8B%9D%E9%BB%91%E6%9A%97%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&sr=1600x1200&cid=amp-dscTJq3TkwNmxacwoleSYw&tid=UA-172083736-2&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&dr=&sd=24&ul=en-us&de=UTF-8&t=pageview&jid=0.9072475874058579&gjid=0.7228047154891823&_r=1&a=4016&z=0.4991121508885692&gtm=2pu000

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl_2022111501.js Show response
securepubads.g.doubleclick.net/gpt/ 381 KB
129 KB 271ms
270ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4c7748a8849068a7262049472b6b640aea77d843c16a57de3e34d3c47e4a01f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 12:10:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 154565
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132177
x-xss-protection: 0
last-modified: Tue, 15 Nov 2022 09:35:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 22 Nov 2023 12:10:15 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 109 B
97 B 813ms
272ms XHR
application/json 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57ba9c79273602051bd0fa9f6dcd52a3f199dc59f134308efeeaad35424b8311

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72
x-xss-protection: 0
expires: Thu, 24 Nov 2022 07:06:21 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7F33 603 B
627 B 992ms
448ms Document
text/html 74.125.24.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=1600x250&w=1600&h=250&ptt=12&adk=2733026255&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-11245073613942821543&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=470780615&nhd=0&adx=0&ady=2763&oid=2&is_amp=5&amp_v=2211042305000&d_imp=1&c=3004016&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&ga_hid=4016&dt=1669273580094&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&bdt=3915&dtd=708&__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012211042305000/v0/amp-ad-0.1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:21 GMT
expires: Thu, 24 Nov 2022 07:06:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame D2A4 107 B
792 B 822ms
273ms Script
application/javascript 142.251.12.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame D2A4 107 B
196 B 576ms
276ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame D2A4 492 B
264 B 302ms
301ms XHR
text/plain 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=212154892497660&correlator=4155126582082574&eid=21065725&output=ldjh&gdfp_req=1&vrg=2022111501&ptt=17&impl=fifs&iu_parts=18087395%2Ccookie&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&adks=64515409&sfv=1-0-40&sc=1&cdm=cdn.aralego.net&abxe=1&dt=1669273580968&lmt=1644386353&dlt=1669273578779&idt=2167&adxs=-12245933&adys=-12245933&biw=-12245933&bih=-12245933&scr_x=-12245933&scr_y=-12245933&ucis=38lp9w4b77xz&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fcdn.aralego.net%2Fucfad%2Fcookie%2FcookieSyncIframe.html&ref=https%3A%2F%2Fwww.bg3.co%2F&top=https%3A%2F%2Fwww.bg3.co%2F&frm=24&vis=1&psz=0x0&msz=0x-1&fws=256&ohw=0&ea=0&ga_vid=1630199500.1669273581&ga_sid=1669273581&ga_hid=1190734050&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3caf63c63a00c4341cbe488bf65c84c1aec84434750f96da4c9e6e6054e4966d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cdn.aralego.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
a9bfe30ce5fab3334b149b95641167a9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame A745 6 KB
3 KB 834ms
277ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a9bfe30ce5fab3334b149b95641167a9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:21 GMT
expires: Fri, 24 Nov 2023 07:06:21 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame B82B 379 B
689 B 841ms
283ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bg3.co&callback=_gfp_s_&client=ca-pub-4485239425924787&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf718e2d0a57c1f8bbbef65f546b0406123073b97591fd8e9b3e8d9840a7845e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 244
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame B82B 107 B
165 B 779ms
276ms Script
application/javascript 142.251.12.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame B82B 107 B
165 B 577ms
275ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 687D 23 KB
10 KB 833ms
494ms Document
text/html 74.125.24.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579903&bpp=12&bdt=2358&idt=1092&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=2&ga_vid=88141136.1669273581&ga_sid=1669273581&ga_hid=812436419&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=2311817258&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774648%2C42531706%2C44760912%2C44774652&oid=2&pvsid=3272243664975390&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.6aapoximh6i1&fsb=1&dtd=1110

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f8397aacd875f5bf04d7a5518605f9c69d93f761551311351ed9076b1040620

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9972
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:21 GMT
expires: Thu, 24 Nov 2022 07:06:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame 030D 107 B
165 B 667ms
278ms Script
application/javascript 142.251.12.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 030D 107 B
165 B 577ms
277ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 030D 492 B
264 B 299ms
298ms XHR
text/plain 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3715708436332925&correlator=1886682843114693&eid=31070949&output=ldjh&gdfp_req=1&vrg=2022111501&ptt=17&impl=fifs&iu_parts=18087395%2Ccookie&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&adks=64515409&sfv=1-0-40&sc=1&cdm=cdn.aralego.net&abxe=1&dt=1669273581125&lmt=1644386353&dlt=1669273578791&idt=2324&adxs=-12245933&adys=-12245933&biw=-12245933&bih=-12245933&scr_x=-12245933&scr_y=-12245933&ucis=yowl1ruq4lja&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fcdn.aralego.net%2Fucfad%2Fcookie%2FcookieSyncIframe.html&ref=https%3A%2F%2Fwww.bg3.co%2F&top=https%3A%2F%2Fwww.bg3.co%2F&frm=24&vis=1&psz=0x0&msz=0x-1&fws=256&ohw=0&ea=0&ga_vid=24234019.1669273581&ga_sid=1669273581&ga_hid=12229997&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

959e00a7e899084acc6c97426136d219a29a54d6765815aedd9f6564f9fd7304

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cdn.aralego.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
adf26f4871ca4e30b54574ba83350ba7.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B03F 6 KB
3 KB 841ms
278ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adf26f4871ca4e30b54574ba83350ba7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:21 GMT
expires: Fri, 24 Nov 2023 07:06:21 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 quant.js Show response
secure.quantserve.com/ 25 KB
10 KB 723ms
236ms Script
application/javascript 103.229.10.247
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.229.10.247 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 275094aa5d73cd24d848e78f0c41c33d9fd61a09d97b9976e5e707dfd24ada00

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: gzip
etag: "nAbmxtqHqaYrwBiADJAeFg=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Thu, 01 Dec 2022 07:06:21 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame FA9B 379 B
317 B 355ms
284ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bg3.co&callback=_gfp_s_&client=ca-pub-4485239425924787&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_fy2021.js?bust=31070969

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03008b212ec2f79798d83c6c71be8bd990d0d1cfc18511b26968a544e94cb723

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame FA9B 107 B
165 B 290ms
275ms Script
application/javascript 142.251.12.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_fy2021.js?bust=31070969

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame FA9B 107 B
122 B 281ms
273ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_fy2021.js?bust=31070969

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7B60 26 KB
12 KB 522ms
521ms Document
text/html 74.125.24.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_fy2021.js?bust=31070969

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cf6cb688f1c87903d82b0dae36b89b90e48a232f5b7d3481b4306648e58a1cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 12002
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:21 GMT
expires: Thu, 24 Nov 2022 07:06:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 454ms
167ms XHR
application/json 104.16.89.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20221124

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.89.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4ce65f09dd4d96cd8ac7103fb9896fed13449485f3a5f707f855f94ba20c395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 24 Nov 2022 07:06:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 14706
x-jsd-version: 1.0.1533
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230021-FRA, cache-yyz4521-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"66d-uDNvjw1GnPJ2+/j4dcNl6z5kM8s"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G7cfITGoD98%2Bzd1ZcEUDHtOTQebjUNFXbVDEu4L4qe3JvlD7pw2grSrMYz%2FihlrAW2lIJqCZwzz%2FEBrZhLVJdw4B3f7zXR6kDGHLpxB9iSb1OHOF2QB3AV2EJ%2B5Cix2st44%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 76f04d2fdf27aadd-SYD

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 375 B
1 KB 1175ms
504ms XHR
application/json 68.67.179.155
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.155 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-44-230-118-67.us-west-2.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

efbff368aabf782e619fabd19f1666b99c1eb9c36f378fa7078a7c9f94227291

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:22 GMT
AN-X-Request-Uuid: e9fe199b-4580-4f56-a4c3-2cfc16b44c2d
Server: nginx/1.21.3
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bg3.co
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 375
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
167 B 1007ms
335ms XHR
text/plain 145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 8
date: Thu, 24 Nov 2022 07:06:22 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 23 B
360 B 870ms
301ms XHR
application/json 35.213.117.18
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.117.18 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 18.117.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f87fe7597315a93740b47ecaa1dfeba39e5ad0de2744cb81a7bdfe20b93df65c

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 24 Nov 2022 07:06:22 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 48

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 3 B
517 B 924ms
311ms XHR
application/json 44.230.118.67
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&CanonicalUrl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&PublisherDomain=https%3A%2F%2Fbg3.co%2F

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.230.118.67 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 24 Nov 2022 07:06:22 GMT
via: kong/2.8.3
x-content-type-options: nosniff
x-kong-proxy-latency: 0
p3p: CP="CAO PSA OUR"
x-kong-upstream-latency: 10
content-length: 3
pragma: no-cache
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
311 B 695ms
399ms XHR
application/json 104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=693656&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%221988be44d424c46%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A7%2C%22msi%22%3A7%2C%22mfu%22%3A3%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A3%2C%22ou%22%3A3%2C%22allu%22%3A3%2C%22ren%22%3Atrue%2C%22version%22%3A%226.19.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2226bd7d00c57f818%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x50%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22250x250%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%22291deedb279bc67%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x50%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%22309249344775cff%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A120%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22120x600%22%7D%7D%5D%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adpushup.com%22%2C%22sid%22%3A%22062d9a21f747ddee7c25d4297776e0aa%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2241aec495-5a65-4167-ad6a-b086e662d31a%22%7D%5D%7D%5D%7D%7D
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.33.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 906454338fe13735ce6841db5e6dca7b6b32fc8f34949f7babd0d00e53b732b8

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cU4KEp9aL%2BhuB8I281Ea1Sixs1AM%2FHxDFPzPoagB%2FdhRGzDW7tyKGj0AK4atze0fyg6hGu76BcHdOL44R57%2BTlx6ln5GKwQc3fLHHrAvC%2FncYA1A3%2BYh8Xu1C4HQB9S0Maqb4I1c"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 76f04d303a4ea7f6-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
561 B 570ms
275ms XHR
application/json 104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=693656&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%221988be44d424c46%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A3%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A3%2C%22ou%22%3A3%2C%22allu%22%3A3%2C%22ren%22%3Atrue%2C%22version%22%3A%226.19.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22291deedb279bc67%22%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B728%2C90%5D%5D%2C%22api%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22placement%22%3A4%2C%22w%22%3A728%2C%22h%22%3A90%7D%7D%2C%7B%22id%22%3A%22309249344775cff%22%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22120x600%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B120%2C600%5D%5D%2C%22api%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22placement%22%3A4%2C%22w%22%3A120%2C%22h%22%3A600%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adpushup.com%22%2C%22sid%22%3A%22062d9a21f747ddee7c25d4297776e0aa%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2241aec495-5a65-4167-ad6a-b086e662d31a%22%7D%5D%7D%5D%7D%7D
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.33.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 906454338fe13735ce6841db5e6dca7b6b32fc8f34949f7babd0d00e53b732b8

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6IPJkhlbOivI7eN0fMj4V%2BJYmfGRK2eMsQ8SSO%2BGILiDwxc9lKzV%2BtbYjbTlHPrCPpkP2YE5OeW3G81Za9OWsLPG39aJrICzXnRs3LGYPih12J07CRA5t3lQQ7llg74Ud6zGn22E"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 76f04d303a51a7f6-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
498 B 1025ms
550ms XHR
application/json 51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

ec2-3-0-240-160.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://www.bg3.co
content-type: application/json
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 adreq Show response
ads.servenobid.com/ 717 B
672 B 1354ms
525ms XHR
application/json 52.16.204.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=1072
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.16.204.248 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-204-248.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 037192b727defa55cc176629db61c9c71c1126decfae405ffc3b0fb355a0d705

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 24 Nov 2022 07:06:22 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

GET
H2 200 arj Show response
adpushup-d.openx.net/w/1.0/ 173 B
383 B 626ms
338ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=223942a9-fa95-462a-87b1-19548ddc18a4%2C915f4f42-2ad0-43c4-914e-212b7a783007%2C5a0da1e1-292f-4e81-a139-5424178ffcc5&nocache=1669273581750&pubcid=41aec495-5a65-4167-ad6a-b086e662d31a&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&aus=728x250%2C728x90%2C690x90%2C690x250%2C675x90%2C675x250%2C670x90%2C670x250%2C650x90%2C650x250%2C650x150%2C630x90%2C630x250%2C602x100%2C600x90%2C600x250%2C580x90%2C570x90%2C550x150%2C468x60%2C320x50%2C320x100%2C300x50%2C300x100%2C300x75%2C300x250%2C250x250%2C200x200%7C728x90%2C690x90%2C675x90%2C670x90%2C650x90%2C630x90%2C600x90%2C580x90%2C570x90%2C468x60%2C320x50%2C300x50%2C300x75%7C120x600&divids=ADP_42753_728X250_77a9c22f-ac02-45dd-96bc-b0896a8a7d5a%2CSTICKY_ADP_42753_728X90_d1c10a72-27b4-4931-8ce7-99a18ebbdbae%2CSTICKY_ADP_42753_120X600_104b282a-bd11-4d8d-ad64-0492063b6cba&aucs=%2C%2C&auid=545618347%2C545618347%2C545618347
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 523f66d2d8700a400e07f715011b5c7f70c0939ea03d4ce7b8c334b37697f9f1

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:22 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 165
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
296 B 531ms
244ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=9f041636-aecb-4e09-9eed-d14ce5cec078&nocache=1669273581750&pubcid=41aec495-5a65-4167-ad6a-b086e662d31a&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A120%2C%22h%22%3A600%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=120&vht=600&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:22 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
504 B 529ms
242ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=0409a360-82df-4a16-86cb-4c20520e7544&nocache=1669273581751&pubcid=41aec495-5a65-4167-ad6a-b086e662d31a&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=728&vht=90&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:22 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
296 B 628ms
342ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=c01579ef-047d-49a9-bcba-cb50e5cc77ce&nocache=1669273581751&pubcid=41aec495-5a65-4167-ad6a-b086e662d31a&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=400&vht=225&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:22 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
502 B 1061ms
330ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:22 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Thu, 24 Nov 2022 07:06:22 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 186 B
406 B 1922ms
387ms XHR
application/json 18.182.157.181
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.182.157.181 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-182-157-181.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 4e6bdc8273911ffdc26546c1427fb819e6ec0e03567f7dbc0f886117df3e31f8

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
x-prebid: pbs-java/1.104.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 185 B
407 B 1851ms
317ms XHR
application/json 18.182.157.181
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.182.157.181 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-182-157-181.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 43edced25fa13130b233a3e890593edf268704c6fb27859dccabbe8130fa2cbb

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
x-prebid: pbs-java/1.104.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 185 B
406 B 2094ms
561ms XHR
application/json 18.182.157.181
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.182.157.181 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-182-157-181.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: f12af25878c91e04db36274164dbe39cf2d5cf0cff996cc662ffdb682dfc2fbe

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
x-prebid: pbs-java/1.104.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 472 B
2 KB 1546ms
464ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=20616&site_id=395958&zone_id=2209398&size_id=15%3B2%3B8&alt_size_ids=2%2C1%2C13%2C14%2C19%2C43%2C44%2C117%3B1%2C43%2C44%3B&rp_schain=1.0,1!adpushup.com,062d9a21f747ddee7c25d4297776e0aa,1,,,&eid_pubcid.org=41aec495-5a65-4167-ad6a-b086e662d31a%5E1&rf=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&tk_flint=pbjs_lite_v6.19.0&x_source.tid=b95def00-bfe8-4a90-be8b-2e1f240e2ae3%3B1865a7be-316c-4fb1-b98f-ee4c4f4b7b61%3Bc0bc98b9-9cf7-4e7f-8b9b-32390a662f31&l_pb_bid_id=51926490bb06fe9%3B52ac080ae4a0d7f%3B5335138016fe0aa&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=3&rand=0.5594940184983714
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 1a65c9cc983fc3c7a1c0539f63eabad907077eb7d5e86aafe2edec40240304e6

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
212 B 776ms
302ms XHR
text/plain 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.19.0&cb=96735601145

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
1 KB 750ms
461ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUPEPKI9
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 81775fb640874a4531889827c7b799b304123f83a846f5e2b05fca663770e098

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:22 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 221
alt-svc: clear
expires: Thu, 24 Nov 2022 07:06:22 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 16 KB
7 KB 854ms
379ms XHR
application/json 3.0.240.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.19.0&referrer=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&tmax=3000

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.0.240.160 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

cd3e41f07460c77454124d3cd6301ed5fe097aee93cfce6a023c22b844b023d4

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:22 GMT
content-encoding: gzip
accept-ch: sec-ch-ua-bitness,sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink,sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width,sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 6412
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D2A4 16 KB
12 KB 586ms
285ms XHR
application/json 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022111501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bae99405f82361b725770b003d4d61a96cc916c5c9c836c96a97ffd3774373d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12424
x-xss-protection: 0

GET
H2 200 adview
googleads.g.doubleclick.net/pagead/ Frame 687D 0
0 583ms
282ms Fetch
text/html 74.125.24.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C5KB-7Rd_Y47NHYqNrAGWwp6ICpj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAmZIh8M5q6Y-qAMBqgSZAk_QnJKhm7-K0LRvJYqR6FAYhYZGXdorSn0-XQpDCv8D_M8eEDj_B579o-SbQFjgqCxgPf22j8d3FHoLmCvp-f6fPVRAmm6TWmslzwdojkpspp0AfAdpwDU5QKPrcjOzQJjvRoHNvR1W3S4DDAedV46cag1qaRkKOKEPju0t3ufLU-xZG5zksy4k_k2Cmd8Mh00wU889TECT0I_LDi5iEbaNmbvtPBeulODS9M5xmZY2RZRowkq7IdITDqFii9ERqiK5rvGtq7fO2ha7gNPutaDZGvHUmpKKELx4pHqzLQuZceTA9JbxddiF39i4KUEEqfbzjyxvn8JmOMafXzllGpN3HMF76eM3V6iWHmBmIvQ2mEtcgqbaniztgAaGvuXguZWg7VygBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi00NDg1MjM5NDI1OTI0Nzg3GOLMGQ&sigh=TeGw3_f8dqQ&uach_m=[UACH]&cid=CAQSGwDq26N98BJa-36dK0drYkleEESE_w69p_093BgBIBM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579903&bpp=12&bdt=2358&idt=1092&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=2&ga_vid=88141136.1669273581&ga_sid=1669273581&ga_hid=812436419&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=2311817258&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774648%2C42531706%2C44760912%2C44774652&oid=2&pvsid=3272243664975390&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.6aapoximh6i1&fsb=1&dtd=1110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579903&bpp=12&bdt=2358&idt=1092&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=2&ga_vid=88141136.1669273581&ga_sid=1669273581&ga_hid=812436419&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=2311817258&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774648%2C42531706%2C44760912%2C44774652&oid=2&pvsid=3272243664975390&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.6aapoximh6i1&fsb=1&dtd=1110
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 24 Nov 2022 07:06:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 24 Nov 2022 07:06:22 GMT

GET
H2 200 notify
rtb.jp2.as.criteo.com/google/auction/ Frame 687D 0
0 935ms
308ms Fetch 182.161.74.19
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.jp2.as.criteo.com/google/auction/notify?profile=14&payload=k8jmDZ_IC9ACmAJi-C0SAgAAACE5AQwCW-6I5uT8IWU3JEEQ7Bd_Y1NUPRFv4Y_Zr-3EABIAAA&wp=Y38X7QAHZo4KKwaKAAehFpRgd6-kKHF0G9XiDg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:22 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 182903
content-length: 0

GET
H2 200 afr.php Show response
ads.as.criteo.com/delivery/r/ Frame DF98 130 KB
45 KB 1208ms
727ms Document
text/html 182.161.73.148
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.as.criteo.com/delivery/r/afr.php?z=Y38X7QAHZo4KKwaKAAehFpRgd6-kKHF0G9XiDg&u=%7CNCLQckH5xX%2BeJY%2Fj68SkLgeaj4j811SfQU9jjUipln8%3D%7C&c1=2P_wVlUbBFsw5yK-nUdqc6nygJ274zNPhQpJEnippfnLPctJAgOVJK5QBvON9Ye9GS_f4NkHgJjP411SnRRB4N9zppcsUR56vxV1q8sBflAhAQttZ-0EuybKnBFRZn2c0ESBY2fNF7ellMAJa4HUCvca1UhK3FGuPGOIxbFfhMlfP-WEM1rHOqdaKXtWF31lsfEjyMlNYJnxYvCCABbJ30676Rd86J7JwSoOpbZrMm0Ad-y0Z-P4WgYE2wcNk817iJE-zI6C7YPyPsTU-H_lBAjFPSbhQJekKYPblldHObsrYeE6i8mWyEgLo3Tx6aHOdcaQH8FRHtG3xF3ZjBsT3QSINRII4hgGUOvzCcXmLVdPPCG1Fh6Ex5QgW-jKgNKE7f2yGTzVgrl1oZJlx1vJpHJv4gp6WJrSf650GNUK67G6GM_reF8BnEDrnplB1ved-oROxdq_5BkER9BjwvxP_jL_Q3WgtX5AgaQbOytPYx9S9Jt81d1_7kvqo_4-10SKkhuVE9LCBNhFTHzIXPRnaQ1-mOhmTINoV1UnRpgMk5qcvf5kfAY2I1ywkFeLHxu_gleR4zJNnKvjBR5-GwS9_Qr1XheLUFnZ4bWnlsTwZ5Mnj5nG61P_m114TZX_WdlG&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC5Q4S7Rd_Y47NHYqNrAGWwp6ICpj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAmZIh8M5q6Y-qAMBqgScAk_QnJKhm7-K0LRvJYqR6FAYhYZGXdorSn0-XQpDCv8D_M8eEDj_B579o-SbQFjgqCxgPf22j8d3FHoLmCvp-f6fPVRAmm6TWmslzwdojkpspp0AfAdpwDU5QKPrcjOzQJjvRoHNvR1W3S4DDAedV46cag1qaRkKOKEPju0t3ufLU-xZG5zksy4k_k2Cmd8Mh00wU889TECT0I_LDi5iEbaNmbvtPBeulODS9M5xmZY2RZRowkq7IdITDqFii9ERqiK5rvGtq7fO2ha7gNPutaDZGvHUmpKKELx4pHqzLQuZceTA9JbxddiF39i4KUEEqfbzj25tvlCD9k_hoLAUhHghhgJS_emgXYaO9uiVdG7_JlVwmkExD1ISQLCBgAaGvuXguZWg7VygBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_19qqSApteAwxD4yCM6tt3oJ_NTOA%26client%3Dca-pub-4485239425924787%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.148 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

c643d8a77cc8c1fd29be63eb77b9dfe23036b2e3ac755249597ee240a355a578

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:22 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.as.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.as.criteo.net/heavyad?cppv=3&cpp=klDYRLldU0qk2rg88I34eTVidx23n6yySedddrqDmu7Z4nn8MIu-1cuo8167O0HmgzXe-lbH1-XXESDYk0a06LZq6iAtZD7M2likGWYxaniItWy2bQ4psLcLmcukAEJoJrLD5Pn0CM2uVQjNsTf34CmtXPxMmhSeis8_LosvG3PWAGDWfKGobPLI6hcgokEUq7Ck_Ps18c5fTGuJVqJktXp1q4E4FsmlugxsVkLDGf626vDzgknEdlcbSLOiA1LwWG2QcDRJSxTu6Nu9"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 63265859
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 687D 3 KB
1 KB 878ms
333ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 04:03:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10959
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Dec 2022 04:03:43 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 687D 18 KB
7 KB 844ms
298ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 16:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53110
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Dec 2022 16:21:12 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 687D 154 KB
48 KB 1444ms
885ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 07:06:23 GMT

GET
H2 200 rules-p-54Nt-1NAaEEe0.js Show response
rules.quantcount.com/ 160 B
633 B 714ms
235ms Script
application/javascript 13.33.33.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-54Nt-1NAaEEe0.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.33.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-33-78.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: edc30a0e05622f71d52d07a0b7b5e94e654ee06854f893be1954336730eb0db6

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 06:27:04 GMT
via: 1.1 475d669d6a669094dfa09def007f90d6.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN2-P1
age: 2359
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 15:29:19 GMT
server: AmazonS3
etag: "05b131079c67d484167fd1b1f6c79577"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: Wcynohvy8-y5uhxVyvbkvM8N9SFwPt7gGgI42cdwtORDj6QhbYsbkQ==

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 030D 16 KB
12 KB 585ms
284ms XHR
application/json 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022111501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

686152a0810e46ebed3f6dcca532326510466e7a434f3ece0fcb48ff250ccf36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12589
x-xss-protection: 0

GET
H2 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7B60 0
0 584ms
283ms Fetch
text/html 74.125.24.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C0xM17Rd_Y97GKLTAyAPtnLyIDZj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAmZIh8M5q6Y-qAMBqgSfAk_Qv_d2MHZAlGnNyEoiPAw9_pY7CbjrEJ29K5XT8WteNGMczcw3hNFvcmJqY3OozCzTcnP4XhlNx5TUvrHxhzhtmuaRG6ZEMa-wAXcJh_g5woEbS3aUqV_xeHc0dkpz-Vd7pAkmCuNst0XmogH1ka0R07flZynZ7RVjCJAEDWyyivV-nqRyeaCL0Rw5MQ5D0gL9hvqjNFdUKXikHxRUdfCsQCW17iLiIkCA0Fq5DR_kepDrA3R0y8Z2vLBX2lXlYK2tBFcqMtjmGwnDdiRkFHoAr-o7tANVSFr1wsVfBDm3-7etxPBgBUwF8lvoiaEp6OZAxYu3OVowM5C6ApoOIn074soN5klcepB_T7rEI6k_SYriZqMcgZgJP_jiUcehgAaGvuXguZWg7VygBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi00NDg1MjM5NDI1OTI0Nzg3GOLMGQ&sigh=NzAiv5ADCtE&uach_m=[UACH]&cid=CAQSKQDq26N9DGZAk9kGGHmjAuB2Hvs5VkBZ0K2Z5-wGOgtl-9brz0HkgcxRGAEgEw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 24 Nov 2022 07:06:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.jp2.as.criteo.com/google/auction/ Frame 7B60 0
0 761ms
309ms Fetch 182.161.74.19
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.jp2.as.criteo.com/google/auction/notify?profile=14&payload=k8jmDZ_IC9ACmAJi-C0SAgAAACE5AQwCW-6I5uT8IWU3JEEQ7Bd_Y3D0294n0kEwQEcXABIAAA&wp=Y38X7QAKI14KciA0AA8ObbBsOxg21dSy8ff_Og

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:21 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 195928
content-length: 0

GET
H2 200 afr.php Show response
ads.as.criteo.com/delivery/r/ Frame 7245 124 KB
43 KB 585ms
278ms Document
text/html 182.161.73.148
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.as.criteo.com/delivery/r/afr.php?z=Y38X7QAKI14KciA0AA8ObbBsOxg21dSy8ff_Og&u=%7CNCLQckH5xX8s08nzYqpk34dZ5RyLyJgExeH4XjiFJNY%3D%7C&c1=2P_wVlUbBFsw5yK-nUdqc6nygJ274zNPhQpJEnippfnLPctJAgOVJK5QBvON9Ye9GS_f4NkHgJjP411SnRRB4N9zppcsUR56OUcfr_9eVaEwY5cO2IlBZFX1c_vpWoPjZ8p2djH_xFeBIOoJug5OSTi-KcIKlLgjJO7GxilrLV0nxrjZgJFxPWNTNZWzEikK5FXEzU3XDkX3w6s9qdQZ0Z05-nue4lJpntJ6BQU-y9FDSZx1027tr3YwAiBonmCqYYhturT14DdcHZX1qBhvuq9vYwo9xwRL8dr6qNjBORzRW55-i9vdJfzKznLHYaJ6XA5jx5kk6NV614opbNQdI6MW2cg3o65xNTLQfp-AvMnoZCCK9C6ZWYnTQeJclUT9CzdQLIb5hq_kg7J9_DTUTQg4Hz_K3vEsRT0LVQk_KmGy2Ix9AD8v2xWUPU0WFBmTklqKCIdoX54EbMTbaHir8B8kbiO-IBx7cPdk7z0cpB9A98U2cakdufaKcj0BERqVoRHFN0icfapDFdl-ocqeZUJt5PQX0QzAF4UV1eOQCzxLu0RuZ1KcGvTyE0qaww02pfZF4II2jLi0jD6vTSpUBGgQwg_Tyg4tW4UAHPylnIEEvohFTp0tgTvaVs5t0MoF&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCAua-7Rd_Y97GKLTAyAPtnLyIDZj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAmZIh8M5q6Y-qAMBqgSiAk_Qv_d2MHZAlGnNyEoiPAw9_pY7CbjrEJ29K5XT8WteNGMczcw3hNFvcmJqY3OozCzTcnP4XhlNx5TUvrHxhzhtmuaRG6ZEMa-wAXcJh_g5woEbS3aUqV_xeHc0dkpz-Vd7pAkmCuNst0XmogH1ka0R07flZynZ7RVjCJAEDWyyivV-nqRyeaCL0Rw5MQ5D0gL9hvqjNFdUKXikHxRUdfCsQCW17iLiIkCA0Fq5DR_kepDrA3R0y8Z2vLBX2lXlYK2tBFcqMtjmGwnDdiRkFHoAr-o7tANVSFr1wsVfBDm3-7etxPBgBUwF8lvoiaEp6OZAxYu3OVowM9K4Iwjr7PRFHUN8eKIK4FNWW7BTKYcnoQIRMDnVP4YlJx8JwLleoqNbgAaGvuXguZWg7VygBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1_xwdeJCpoIreRslQ3hy4_fft3kA%26client%3Dca-pub-4485239425924787%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.148 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

6f824f84361422f91fdf7aa1bb490f1a35c94ae3860d970d47e7c6788789d688

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:22 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.as.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.as.criteo.net/heavyad?cppv=3&cpp=qMK3crldU0qk2rg8Pjr9flsy14TTMavGFnDAeA8rFeoedFNJjrIiyZ5PrLqN1teh1eqYL2d5oR3IV5BSsRD2SH8TYBhA0pYEYmqhtyoRogEL6SxeuNFAcQZfefnRsyv_-Qtyp8O5rPEUGDxNqkdO3sS31fpufPIFeIkVrdrYLjBvsfDsLPGj8iK6_Lkxmsbd4T8BTEkDMQL14t3lIPmXKwWd4HcqRPZVSiXvlZ37t7oJrr9jfSKJYVVwduHsL9XHdOLxmF3D7s4wIZdb"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 42360800
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 7B60 3 KB
1 KB 716ms
345ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 04:03:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10959
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Dec 2022 04:03:43 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E560 1 KB
643 B 271ms
270ms Document
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 79195
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 23 Nov 2022 09:06:27 GMT
etag: 48472445140208031
expires: Thu, 24 Nov 2022 09:06:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 7B60 18 KB
8 KB 630ms
271ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 16:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53110
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Dec 2022 16:21:12 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 7B60 0
0 863ms
320ms Image
text/html 74.125.24.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS9QhfYitdS4qwCx3hMzBjp24-buIE8AQBRAe6cWD_6bGy6h4dMeeIaWyeFX2aUzXk6Bow93KaCZCZoSO3aKXV7vemxnA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.24.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f106.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7B60 154 KB
47 KB 1647ms
1273ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 07:06:23 GMT

POST
H/1.1 204
No Content log
aplogger.adpushup.com/ 0
119 B 856ms
280ms Ping
text/plain 52.183.162.69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aplogger.adpushup.com/log?event=glimpse_pageView&data=eyJzZXNzaW9uSWQiOiIxNjIxMzlfMTY2OTI3MzU4MjI3MiIsInVzZXJJZCI6IjEwNDE3MF8xNjY5MjczNTgyMjcyIiwic2l0ZUlkIjo0Mjc1MywicGxhdGZvcm0iOiJERVNLVE9QIiwicGFnZUlkIjoiMjQ1MzQxXzE2NjkyNzM1ODIyNzIiLCJwYWdlUGF0aCI6IiUyRmElMkZjaGVuLXNoaS16aG9uZy14dS16dW8temktamktbGluZy1odW4temh1LXJlbi1qaWFuZy1tby1hbi14aWFuZy14aW4tenVpLXpob25nLWd1YW5nLW1pbmcta2UteWktemhhbi1zaGVuZy1oZWktYW4uaHRtbCIsImhvc3RuYW1lIjoid3d3LmJnMy5jbyIsInVybCI6Imh0dHBzJTNBJTJGJTJGd3d3LmJnMy5jbyUyRmElMkZjaGVuLXNoaS16aG9uZy14dS16dW8temktamktbGluZy1odW4temh1LXJlbi1qaWFuZy1tby1hbi14aWFuZy14aW4tenVpLXpob25nLWd1YW5nLW1pbmcta2UteWktemhhbi1zaGVuZy1oZWktYW4uaHRtbCIsInBoYXNlIjowLCJ1c2VyVHlwZSI6Ik5FVyIsInByZXZpZXdWYXJpYXRpb24iOiJub1ByZXZpZXdQYWdlIiwiZXhwZXJpbWVudFBhZ2UiOmZhbHNlLCJ0aW1lc3RhbXAiOjE2NjkyNzM1ODIyNzJ9
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.183.162.69 Mumbai, India, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Date: Thu, 24 Nov 2022 07:06:22 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H2 404 L2EvY2hlbi1zaGktemhvbmcteHUtenVvLXppLWppLWxpbmctaHVuLXpodS1yZW4tamlhbmctbW8tYW4teGlhbmcteGluLXp1aS16aG9uZy1ndWFuZy1taW5nLWtlLXlpLXpoYW4tc2hlbmctaGVpLWFuLmh0bWw=.json Show response
cdn.adpushup.com/42753/ 555 B
819 B 671ms
671ms XHR
text/html 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/L2EvY2hlbi1zaGktemhvbmcteHUtenVvLXppLWppLWxpbmctaHVuLXpodS1yZW4tamlhbmctbW8tYW4teGlhbmcteGluLXp1aS16aG9uZy1ndWFuZy1taW5nLWtlLXlpLXpoYW4tc2hlbmctaGVpLWFuLmh0bWw=.json
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 6d83b77c3d8c5c0ccc7078540a1fb0bd9fa43eeb82b89f83264d469aa100c088

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Thu, 24 Nov 2022 07:06:22 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=MISS, edge; dur=125, origin; dur=206
content-length: 555
expires: Thu, 24 Nov 2022 08:06:22 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E560
Redirect Chain

https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESELhzXcZ44Pay4Iyum3NcZLk&google_cver=1&google_push=ASkJ3FadNapeTcR9KQ1g05gzq-MBWphQrE1ggWSqRWudg_r6MKLDXch1OejZMPlZlxCak2M_CTwH_kx_IK...
https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESELhzXcZ44Pay4Iyum3NcZLk&google_cver=1&google_push=ASkJ3FadNapeTcR9KQ1g05gzq-MBWphQrE1ggWSqRWudg_r6MKLDXch1OejZMPlZlxCak2M_CTwH_kx_IK...
https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=ASkJ3FadNapeTcR9KQ1g05gzq-MBWphQrE1ggWSqRWudg_r6MKLDXch1OejZMPlZlxCak2M_CTwH_kx_IKCK2fy7NAgQHsV8pgSKgwrrWO0_E55cIQouKK9cOGCdI7jq_c...

170 B
188 B

275ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=ASkJ3FadNapeTcR9KQ1g05gzq-MBWphQrE1ggWSqRWudg_r6MKLDXch1OejZMPlZlxCak2M_CTwH_kx_IKCK2fy7NAgQHsV8pgSKgwrrWO0_E55cIQouKK9cOGCdI7jq_c7XXJvaY7MqL5Rsu7IbaWlzfg&google_hm=MDMwMzAwMDFfNjM3ZjE3ZWY1OGIxNA%3D%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 24 Nov 2022 07:06:23 GMT
server: nginx
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=ASkJ3FadNapeTcR9KQ1g05gzq-MBWphQrE1ggWSqRWudg_r6MKLDXch1OejZMPlZlxCak2M_CTwH_kx_IKCK2fy7NAgQHsV8pgSKgwrrWO0_E55cIQouKK9cOGCdI7jq_c7XXJvaY7MqL5Rsu7IbaWlzfg&google_hm=MDMwMzAwMDFfNjM3ZjE3ZWY1OGIxNA%3D%3D
content-type: text/html; charset=UTF-8
cache-control: no-cache
keep-alive: timeout=10
access-control-allow-headers: Origin

GET
H/1.1 200
200 asr
aid.send.microad.jp/g/ Frame E560 43 B
641 B 815ms
269ms Image
image/gif 202.233.84.1
MICROAD MicroAd

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aid.send.microad.jp/g/asr?google_gid=CAESEJVKeUgUAgz1VGbqW0q6kU0&google_cver=1&google_push=ASkJ3FayzbcEcyGqBYDChQHMSGZoHKXY9lFWFE4Uv9aYAAP-NDBFXG51ODZafkSImunirlh3PChK_GhFMlPTrEwm8tQ8xOVtoeo9ictUU4wUk0RTbJyEN1NE66AmVHbbUnJsLRHqax4pBZbm7LawhcsTi5A

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

202.233.84.1 , Japan, ASN131957 (MICROAD MicroAd, Inc., JP),

Reverse DNS

Software

Apache /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 24 Nov 2022 07:06:23 GMT
Strict-Transport-Security: max-age=3600
Server: Apache
P3P: policyref="http://www.microad.jp/w3c/p3p.xml",CP="NOI DSP COR NID DEVo PSAo OUR STP STA PRE"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Connection: close
Access-Control-Allow-Headers: origin, x-requested-with, If-Modified-Since, content-type, Pragma, Cache-Control
Content-Length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E560
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEB-NXeywxAJBTy-CNMzmTfc&google_cver=1&google_push=ASkJ3Fa4TncaRDysvtGKEm0jLRG1Ut8sT9Epo6tAGW4YgQAM-xlHeyQ-ahd00WN3oeD-jPfb1OuRze1c...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEB-NXeywxAJBTy-CNMzmTfc&google_cver=1&google_push=ASkJ3Fa4TncaRDysvtGKEm0jLRG1Ut8sT9Epo6tAGW4YgQAM-xlHeyQ-ahd00WN3oeD-jPfb1Ou...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzA2OTU2NDg4ODgwODE4ODEyNg&google_push=ASkJ3Fa4TncaRDysvtGKEm0jLRG1Ut8sT9Epo6tAGW4YgQAM-xlHeyQ-ahd00WN3oeD-jPfb1OuRze...

170 B
188 B

566ms
275ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzA2OTU2NDg4ODgwODE4ODEyNg&google_push=ASkJ3Fa4TncaRDysvtGKEm0jLRG1Ut8sT9Epo6tAGW4YgQAM-xlHeyQ-ahd00WN3oeD-jPfb1OuRze1czaefNEHSzQMkkiZ5hcC4JliidJPc3fkccuix3d_hG4n61Cv4F2z7ICBkLBmErPUYYpzQJ0xN-r8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzA2OTU2NDg4ODgwODE4ODEyNg&google_push=ASkJ3Fa4TncaRDysvtGKEm0jLRG1Ut8sT9Epo6tAGW4YgQAM-xlHeyQ-ahd00WN3oeD-jPfb1OuRze1czaefNEHSzQMkkiZ5hcC4JliidJPc3fkccuix3d_hG4n61Cv4F2z7ICBkLBmErPUYYpzQJ0xN-r8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E560
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEMwByQ-ot_Cvk6RREsY2tic&google_cver=1&google_push=ASkJ3Fac2awX-ZUx0vi6M8--0u9cJfQah7c030x_mCqnDr0u4NLwCgpgPECwMUmzGYxKrA8VyfaUw7JyiH-Each...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=dFmhoN2QSnVLLSor1a7kgnRaSso&google_push=ASkJ3Fac2awX-ZUx0vi6M8--0u9cJfQah7c030x_mCqnDr0u4NLwCgpgPECwMUmzGYxKrA8VyfaUw7JyiH-Eac...

170 B
188 B

311ms
278ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=dFmhoN2QSnVLLSor1a7kgnRaSso&google_push=ASkJ3Fac2awX-ZUx0vi6M8--0u9cJfQah7c030x_mCqnDr0u4NLwCgpgPECwMUmzGYxKrA8VyfaUw7JyiH-EachWMRXgeidykggI_OoObMCEjoMSbLzXcbVJD_WKurVAhYYFIZoe6UzpKsabbNAnhx44-Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=dFmhoN2QSnVLLSor1a7kgnRaSso&google_push=ASkJ3Fac2awX-ZUx0vi6M8--0u9cJfQah7c030x_mCqnDr0u4NLwCgpgPECwMUmzGYxKrA8VyfaUw7JyiH-EachWMRXgeidykggI_OoObMCEjoMSbLzXcbVJD_WKurVAhYYFIZoe6UzpKsabbNAnhx44-Q
Date: Thu, 24 Nov 2022 07:06:23 GMT
Connection: keep-alive
Content-Length: 296
Content-Type: text/html; charset=utf-8

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E560
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEGoycIGA5B_Wf1PxGjOmzes&google_cver=1&google_push=ASkJ3FYvPsrfTf3kkeG2QMH8pjH8DzqWe7Oh4MhEFitmtAfFaBmgYcJ9NzMm9B4F9pbx-QhuaFb6l298q42zpPuX...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=6ec80315&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=ASkJ3FYvPsrfTf3kkeG2QMH8pjH8DzqWe7Oh4MhEFitmtAfF...

170 B
329 B

276ms
275ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=6ec80315&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=ASkJ3FYvPsrfTf3kkeG2QMH8pjH8DzqWe7Oh4MhEFitmtAfFaBmgYcJ9NzMm9B4F9pbx-QhuaFb6l298q42zpPuXIJJxM8ID6ju3UuiOExwO_HElJENoeoOigZSJLkS94edK85_edoVfGYdl8aqL04gqspM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 24 Nov 2022 07:06:22 GMT
via: 1.1 09c63a510feb1b96fe87d2cfe41d34ae.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: SIN2-P2
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=6ec80315&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=ASkJ3FYvPsrfTf3kkeG2QMH8pjH8DzqWe7Oh4MhEFitmtAfFaBmgYcJ9NzMm9B4F9pbx-QhuaFb6l298q42zpPuXIJJxM8ID6ju3UuiOExwO_HElJENoeoOigZSJLkS94edK85_edoVfGYdl8aqL04gqspM
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: AuQr_nHoSZoKLrkJelcIqgU3RPTZ0z7t20s5XPzaMCx_pPL0NWiHfQ==

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E560
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESELRvZ1MUSUM-hIdvZE2109c&google_cver=1&google_push=ASkJ3FYg5h8RjLeAmF_YOZF9uV00In8wERgRSWaAbSYRW6662DlTY-EQNBEhw-PVc0HsCfiOtuWTHhTi1lzvXZA2oB5cSJYqEP...
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=0&gdpr_consent=&us_privacy=&sync=1&google_push=ASkJ3FYg5h8RjLeAmF_YOZF9uV00In8wERgRSWaAbSYRW6662DlTY-EQNBEhw-PVc0HsCfiOtuWTHhTi1lzvXZA2oB5cSJYqEPh...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NzAyNzg0MDM4NDkxMTczNjI3Mzg4&google_push=ASkJ3FYg5h8RjLeAmF_YOZF9uV00In8wERgRSWaAbSYRW6662DlTY-EQNBEhw-PV...

170 B
232 B

577ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NzAyNzg0MDM4NDkxMTczNjI3Mzg4&google_push=ASkJ3FYg5h8RjLeAmF_YOZF9uV00In8wERgRSWaAbSYRW6662DlTY-EQNBEhw-PVc0HsCfiOtuWTHhTi1lzvXZA2oB5cSJYqEPhmL3P8CLQLAT3uXaYIAdXpNd7EqgGRwhNWrTb3KuviGiXFwbzroHkWHA4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NzAyNzg0MDM4NDkxMTczNjI3Mzg4&google_push=ASkJ3FYg5h8RjLeAmF_YOZF9uV00In8wERgRSWaAbSYRW6662DlTY-EQNBEhw-PVc0HsCfiOtuWTHhTi1lzvXZA2oB5cSJYqEPhmL3P8CLQLAT3uXaYIAdXpNd7EqgGRwhNWrTb3KuviGiXFwbzroHkWHA4
date: Thu, 24 Nov 2022 07:06:23 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E560
Redirect Chain

https://b1sync.zemanta.com/usersync/googleopenbidding/?google_gid=CAESEDEmfvkFNDgbKCGmS8eifmY&google_cver=1&google_push=ASkJ3FYozloIjqW9wtYqP6UcY1yS7usLnyLPqmc0oGSXA9DW9Xnw0DUvBKpymNZ1ecVCnqaxqnpj7...
https://b1sync.zemanta.com/usersync/googleopenbidding/?google_cver=1&google_gid=CAESEDEmfvkFNDgbKCGmS8eifmY&google_push=ASkJ3FYozloIjqW9wtYqP6UcY1yS7usLnyLPqmc0oGSXA9DW9Xnw0DUvBKpymNZ1ecVCnqaxqnpj7...
https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=ASkJ3FYozloIjqW9wtYqP6UcY1yS7usLnyLPqmc0oGSXA9DW9Xnw0DUvBKpymNZ1ecVCnqaxqnpj7EFTLbs_sq6C5V7wizmJhAA-ZA1JeQMwczPQXzQ9VOyXxeSbgjw...

170 B
188 B

274ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=ASkJ3FYozloIjqW9wtYqP6UcY1yS7usLnyLPqmc0oGSXA9DW9Xnw0DUvBKpymNZ1ecVCnqaxqnpj7EFTLbs_sq6C5V7wizmJhAA-ZA1JeQMwczPQXzQ9VOyXxeSbgjwIAHI4SjIlNvI4U4Qklud4vTVsT0pj&google_hm=RzFqS24yaVJOQlo4RUxTQ1BQRjM=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:23 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=ASkJ3FYozloIjqW9wtYqP6UcY1yS7usLnyLPqmc0oGSXA9DW9Xnw0DUvBKpymNZ1ecVCnqaxqnpj7EFTLbs_sq6C5V7wizmJhAA-ZA1JeQMwczPQXzQ9VOyXxeSbgjwIAHI4SjIlNvI4U4Qklud4vTVsT0pj&google_hm=RzFqS24yaVJOQlo4RUxTQ1BQRjM=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 296
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame E560 0
232 B 818ms
272ms Image
text/html 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KsAI5JoGvVKn_q36kIptCiYp_wPG41JJ0f8pVDSQJUyp11xGmXeWIPeK4pFUztp2sJy6U2ng

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669273581&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669273579550&bpp=13&bdt=1982&idt=1931&shv=r20221110&mjsv=m202211150101&ptt=5&saldr=sa&correlator=6156873133434&frm=23&ife=1&pv=1&ga_vid=1769825251.1669273581&ga_sid=1669273581&ga_hid=9636040&ga_fc=0&ga_cid=amp-dscTJq3TkwNmxacwoleSYw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1380&biw=1600&bih=1200&isw=336&ish=280&ifk=875075027&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706%2C31070969%2C44777949%2C31060566&oid=2&pvsid=1162199652779195&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.9ewed7fbiyrg&btvi=1&fsb=1&dtd=1950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D2A4 17 KB
7 KB 1053ms
1053ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 07:06:23 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 030D 17 KB
6 KB 919ms
919ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 07:06:23 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 7245 2 KB
1 KB 946ms
465ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.as.criteo.com
URL: https://ads.as.criteo.com/delivery/r/afr.php?z=Y38X7QAKI14KciA0AA8ObbBsOxg21dSy8ff_Og&u=%7CNCLQckH5xX8s08nzYqpk34dZ5RyLyJgExeH4XjiFJNY%3D%7C&c1=2P_wVlUbBFsw5yK-nUdqc6nygJ274zNPhQpJEnippfnLPctJAgOVJK5QBvON9Ye9GS_f4NkHgJjP411SnRRB4N9zppcsUR56OUcfr_9eVaEwY5cO2IlBZFX1c_vpWoPjZ8p2djH_xFeBIOoJug5OSTi-KcIKlLgjJO7GxilrLV0nxrjZgJFxPWNTNZWzEikK5FXEzU3XDkX3w6s9qdQZ0Z05-nue4lJpntJ6BQU-y9FDSZx1027tr3YwAiBonmCqYYhturT14DdcHZX1qBhvuq9vYwo9xwRL8dr6qNjBORzRW55-i9vdJfzKznLHYaJ6XA5jx5kk6NV614opbNQdI6MW2cg3o65xNTLQfp-AvMnoZCCK9C6ZWYnTQeJclUT9CzdQLIb5hq_kg7J9_DTUTQg4Hz_K3vEsRT0LVQk_KmGy2Ix9AD8v2xWUPU0WFBmTklqKCIdoX54EbMTbaHir8B8kbiO-IBx7cPdk7z0cpB9A98U2cakdufaKcj0BERqVoRHFN0icfapDFdl-ocqeZUJt5PQX0QzAF4UV1eOQCzxLu0RuZ1KcGvTyE0qaww02pfZF4II2jLi0jD6vTSpUBGgQwg_Tyg4tW4UAHPylnIEEvohFTp0tgTvaVs5t0MoF&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCAua-7Rd_Y97GKLTAyAPtnLyIDZj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAmZIh8M5q6Y-qAMBqgSiAk_Qv_d2MHZAlGnNyEoiPAw9_pY7CbjrEJ29K5XT8WteNGMczcw3hNFvcmJqY3OozCzTcnP4XhlNx5TUvrHxhzhtmuaRG6ZEMa-wAXcJh_g5woEbS3aUqV_xeHc0dkpz-Vd7pAkmCuNst0XmogH1ka0R07flZynZ7RVjCJAEDWyyivV-nqRyeaCL0Rw5MQ5D0gL9hvqjNFdUKXikHxRUdfCsQCW17iLiIkCA0Fq5DR_kepDrA3R0y8Z2vLBX2lXlYK2tBFcqMtjmGwnDdiRkFHoAr-o7tANVSFr1wsVfBDm3-7etxPBgBUwF8lvoiaEp6OZAxYu3OVowM9K4Iwjr7PRFHUN8eKIK4FNWW7BTKYcnoQIRMDnVP4YlJx8JwLleoqNbgAaGvuXguZWg7VygBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1_xwdeJCpoIreRslQ3hy4_fft3kA%26client%3Dca-pub-4485239425924787%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 7245 2 KB
1 KB 946ms
466ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 7245 308 B
636 B 713ms
236ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 7245 293 B
621 B 714ms
238ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 lg.php
cat.sg1.as.criteo.com/delivery/ Frame 7245 43 B
347 B 719ms
242ms Image
image/gif 182.161.73.132
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.sg1.as.criteo.com/delivery/lg.php?cppv=3&cpp=EHN4ndcoigJOBeypeqOkoG4CeIweh1kk4OIV6ORzXTGPal2JKEH5YKcKdOYiMdssmkyepVV4_-phE5QgnzcXJvCejLJPn-Z21lJwwZr9TFM_ga62pTIXWTPAxT5cNn99RxMijQmb05OARj28JVSrg8TiV4CVD70QxkSaOnNlScpX-h3FHXHeRHbDbNBjl3yb4yQ_izm4O7NDne1SLjXP2sNDpVMBOF-cXz8XOGe1xIgKsKqHVYq8ebKWkqoxMuR8h2YD-cxPWUlqoP5OOnNe9i3JoMSxAx46mAYdTpzPVXC3f6A1b3LM98vcPvWXfZUxMVlp_7RtciGpSgW_eK8YKPDq1vckFgMkx2xZO5ooIqvk1ETZz7M1iJTleW9jwJOw1b6Cdh0iszsazXxJ38_6um7AIdt7pBlxPnNFaKckiRTn1Vbf

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.132 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2989653
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 pixel;r=54541891;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html;uh=e5...
pixel.quantserve.com/ 35 B
371 B 317ms
237ms Image
image/gif 103.229.10.247
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=54541891;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=1;fpa=P0-648999976-1669273581974;pbc=41aec495-5a65-4167-ad6a-b086e662d31a;ns=0;ce=1;qjs=1;qv=48c6ea86-20221121114006;cm=;gdpr=0;ref=;d=bg3.co;dst=0;et=1669273582695;tzo=0;ogl=;ses=b3ca055b-ce74-4bfa-a4fa-df041bde7435

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.229.10.247 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 7B60 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0266114342dad4dd7e4674a3c8bacdf58beea9d154142b0f79fc0df0f80db0f0

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 687D 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9c1b51d08e8bc316cbe926950f90563f4221a7d99dab88b67b2cc6b2d2f05524

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 7245 12 KB
5 KB 443ms
149ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 726764
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BYlSjrvJRnmn%2BF81CZaPwT6Ik8TaosnUcHJfaosnqc8%2FqMjuEdL3K0Qpt1r5aREERDIEfX880sMNJKPBr7tDz4wasekrHnMEqc7S2EcWI8ocR50TB7ngnBDWysrDYC8hLL9n4vMB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 76f04d38bb4eaad8-SYD
expires: Tue, 14 Nov 2023 07:06:23 GMT

GET
H2 200 5ab904e70ba04f04aab36995c6fce95d_futura+book+font.woff
static.criteo.net/design/dt/ Frame 7245 24 KB
24 KB 704ms
235ms Font
application/octet-stream 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/5ab904e70ba04f04aab36995c6fce95d_futura+book+font.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

0b81ebd295c56386af5d622092d29db6ecb12a7f8dc8be80fe54cbbfa3d3216e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
Origin: https://ads.as.criteo.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 12 Feb 2018 16:12:56 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5a81bd08-5f2c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
77 KB 583ms
281ms Script
application/javascript 142.250.4.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

064cd0649722cbe07af45f92a1a7fc2e6c7217a0fd29302da93056791875a22a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 78329
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 24 Nov 2022 07:06:23 GMT

POST
H/1.1 204
No Content log
aplogger.adpushup.com/ 0
119 B 282ms
280ms Ping
text/plain 52.183.162.69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aplogger.adpushup.com/log?event=linkPreview_failed_JSONRequest&data=eyJzaXRlSWQiOjQyNzUzLCJ1cmwiOiIvYS9jaGVuLXNoaS16aG9uZy14dS16dW8temktamktbGluZy1odW4temh1LXJlbi1qaWFuZy1tby1hbi14aWFuZy14aW4tenVpLXpob25nLWd1YW5nLW1pbmcta2UteWktemhhbi1zaGVuZy1oZWktYW4uaHRtbCIsInRpbWUiOjE2NjkyNzM1ODI5NDl9
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.183.162.69 Mumbai, India, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Date: Thu, 24 Nov 2022 07:06:23 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 7245 12 KB
6 KB 279ms
239ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 7245 23 KB
23 KB 979ms
492ms Image
image/png 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?h=92&m=0&partner=71731&q=80&r=0&u=http%3A%2F%2Fstatic.sg1.as.criteo.net%2Fdesign%2Fdt%2F38393%2F210902%2F5040eeb44263442baf5e2a4c19e0442e_horizontal.png&v=3&w=668&s=WkXOAvaQoCmLcMM2m3Gv6Scf

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

bb9338391e8fd82b612d7b68d8b3957b335090b5d94ef80df781105f1a706e1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=26428119
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23369
expires: Tue, 26 Sep 2023 04:15:03 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 7245 14 KB
14 KB 1314ms
828ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71731&q=80&r=0&u=https%3A%2F%2Fwww.macpac.co.nz%2Fon%2Fdemandware.static%2F-%2FSites-macpac-master-catalog%2Fdefault%2Fdwb5fa7474%2Fimages%2F120546-Master%2F120546-BSWVI-front.jpg&v=3&w=400&s=z3CSRw6wx_EvCoTEiIY8Yavo&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

687d4404c50eb4af46e57d9f4c3a9e06a3fa8cf548979cd11864767dbc3094ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:22 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2575782
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 13864
expires: Sat, 24 Dec 2022 02:36:06 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 7245 9 KB
9 KB 954ms
468ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71731&q=80&r=0&u=https%3A%2F%2Fwww.macpac.co.nz%2Fon%2Fdemandware.static%2F-%2FSites-macpac-master-catalog%2Fdefault%2Fdw44dd16d8%2Fimages%2F119368-Master%2F119368-PERD0-front.jpg&v=3&w=400&s=cj2TRb5Artj6w1mPGBiG03QD&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

2a4cbb5ae89d8d027917e1587361187dc60f10651aa9e5ee1ba9bd94f18b6589

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2466750
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9332
expires: Thu, 22 Dec 2022 20:18:54 GMT

POST
H2 200 all
csm.as.criteo.net/ Frame 7245 0
127 B 718ms
237ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.as.criteo.net/all?cppv=3&cpp=qMK3crldU0qk2rg8Pjr9flsy14TTMavGFnDAeA8rFeoedFNJjrIiyZ5PrLqN1teh1eqYL2d5oR3IV5BSsRD2SH8TYBhA0pYEYmqhtyoRogEL6SxeuNFAcQZfefnRsyv_-Qtyp8O5rPEUGDxNqkdO3sS31fpufPIFeIkVrdrYLjBvsfDsLPGj8iK6_Lkxmsbd4T8BTEkDMQL14t3lIPmXKwWd4HcqRPZVSiXvlZ37t7oJrr9jfSKJYVVwduHsL9XHdOLxmF3D7s4wIZdb&sds=2&rev=83599&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 24 Nov 2022 07:06:22 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 7245 2 KB
1 KB 240ms
236ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 7245 2 KB
1 KB 240ms
237ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame DF98 2 KB
1 KB 266ms
235ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.as.criteo.com
URL: https://ads.as.criteo.com/delivery/r/afr.php?z=Y38X7QAHZo4KKwaKAAehFpRgd6-kKHF0G9XiDg&u=%7CNCLQckH5xX%2BeJY%2Fj68SkLgeaj4j811SfQU9jjUipln8%3D%7C&c1=2P_wVlUbBFsw5yK-nUdqc6nygJ274zNPhQpJEnippfnLPctJAgOVJK5QBvON9Ye9GS_f4NkHgJjP411SnRRB4N9zppcsUR56vxV1q8sBflAhAQttZ-0EuybKnBFRZn2c0ESBY2fNF7ellMAJa4HUCvca1UhK3FGuPGOIxbFfhMlfP-WEM1rHOqdaKXtWF31lsfEjyMlNYJnxYvCCABbJ30676Rd86J7JwSoOpbZrMm0Ad-y0Z-P4WgYE2wcNk817iJE-zI6C7YPyPsTU-H_lBAjFPSbhQJekKYPblldHObsrYeE6i8mWyEgLo3Tx6aHOdcaQH8FRHtG3xF3ZjBsT3QSINRII4hgGUOvzCcXmLVdPPCG1Fh6Ex5QgW-jKgNKE7f2yGTzVgrl1oZJlx1vJpHJv4gp6WJrSf650GNUK67G6GM_reF8BnEDrnplB1ved-oROxdq_5BkER9BjwvxP_jL_Q3WgtX5AgaQbOytPYx9S9Jt81d1_7kvqo_4-10SKkhuVE9LCBNhFTHzIXPRnaQ1-mOhmTINoV1UnRpgMk5qcvf5kfAY2I1ywkFeLHxu_gleR4zJNnKvjBR5-GwS9_Qr1XheLUFnZ4bWnlsTwZ5Mnj5nG61P_m114TZX_WdlG&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC5Q4S7Rd_Y47NHYqNrAGWwp6ICpj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAmZIh8M5q6Y-qAMBqgScAk_QnJKhm7-K0LRvJYqR6FAYhYZGXdorSn0-XQpDCv8D_M8eEDj_B579o-SbQFjgqCxgPf22j8d3FHoLmCvp-f6fPVRAmm6TWmslzwdojkpspp0AfAdpwDU5QKPrcjOzQJjvRoHNvR1W3S4DDAedV46cag1qaRkKOKEPju0t3ufLU-xZG5zksy4k_k2Cmd8Mh00wU889TECT0I_LDi5iEbaNmbvtPBeulODS9M5xmZY2RZRowkq7IdITDqFii9ERqiK5rvGtq7fO2ha7gNPutaDZGvHUmpKKELx4pHqzLQuZceTA9JbxddiF39i4KUEEqfbzj25tvlCD9k_hoLAUhHghhgJS_emgXYaO9uiVdG7_JlVwmkExD1ISQLCBgAaGvuXguZWg7VygBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_19qqSApteAwxD4yCM6tt3oJ_NTOA%26client%3Dca-pub-4485239425924787%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame DF98 2 KB
1 KB 267ms
237ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame DF98 308 B
636 B 496ms
467ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame DF98 293 B
621 B 498ms
471ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 lg.php
cat.sg1.as.criteo.com/delivery/ Frame DF98 43 B
348 B 267ms
238ms Image
image/gif 182.161.73.132
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.sg1.as.criteo.com/delivery/lg.php?cppv=3&cpp=n1r4u9coigJOBeypeqOkoG4CeIwUohdKDnUqACD246mc56_50J_wZe2iyTUfcL-MCGon4_zEk7ZbYFMMBmO1oigqJzuL-6W0VukCC2Scot8xaAFbBfHmJEum18oKnwxATttH5n3JF-ZnFYkE04_0Zg-7WHx2ZrsKk9q94SpRAz_2Utvaxh7cVH00Byqh7v8VM4oHjjcXp6xjt8S3SZ5CleY02az9ENrnR4LUenYJedt3pwayZ5C_VpuOY1ikOBmfHXjAIEQrxaL8XmBH11p-WbVi9xdilmlTrFKqsYUm1Q-zHAVqm8RANOx0KklzHlusVaBqYaWvGDoEwPuWSf4wnY3n-45qHrBZouPFDdpUzNaIMCVHb_21RcQF40RXGPYqD6iV90maJqBn6XZdarcbFncBJMjdE2LiMg66u0CGu3t2Qqil

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.132 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:22 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2762012
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 5ab904e70ba04f04aab36995c6fce95d_futura+book+font.woff
static.criteo.net/design/dt/ Frame DF98 24 KB
24 KB 692ms
489ms Font
application/octet-stream 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/5ab904e70ba04f04aab36995c6fce95d_futura+book+font.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

0b81ebd295c56386af5d622092d29db6ecb12a7f8dc8be80fe54cbbfa3d3216e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
Origin: https://ads.as.criteo.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 12 Feb 2018 16:12:56 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5a81bd08-5f2c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame DF98 12 KB
5 KB 396ms
151ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 726764
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T4l5RY6ff99R%2FX29wPKQbLFyhrVZ%2BlOqB1ZVnbTGrUy%2B52%2FZfBYJqR4%2FXFIut2HhRvbmLT9CvumxlnYJW6xXO1FtG56uwEl5PES2nmDvyvywyJi0ORxf4euHU4KETcHxBSlfr9Hv"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 76f04d38bb51aad8-SYD
expires: Tue, 14 Nov 2023 07:06:23 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame DF98 12 KB
6 KB 364ms
364ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame DF98 23 KB
23 KB 1072ms
750ms Image
image/png 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

bb9338391e8fd82b612d7b68d8b3957b335090b5d94ef80df781105f1a706e1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=26428119
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23369
expires: Tue, 26 Sep 2023 04:15:03 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame DF98 14 KB
14 KB 812ms
491ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

687d4404c50eb4af46e57d9f4c3a9e06a3fa8cf548979cd11864767dbc3094ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2575782
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 13864
expires: Sat, 24 Dec 2022 02:36:06 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame DF98 4 KB
4 KB 770ms
466ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71731&q=80&r=0&u=https%3A%2F%2Fwww.macpac.co.nz%2Fon%2Fdemandware.static%2F-%2FSites-macpac-master-catalog%2Fdefault%2Fdw389cd303%2Fimages%2F119248-Master%2F119248-DEPFR-front.jpg&v=3&w=400&s=zSNPW6PcsasR_35aLEfKhZ3Y&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

f30782b939f5a62bc9986cd1c972658c84dcdb1e00d859879d33485f64423560

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=330681
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4086
expires: Mon, 28 Nov 2022 02:57:45 GMT

POST
H2 200 all
csm.as.criteo.net/ Frame DF98 0
128 B 533ms
236ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.as.criteo.net/all?cppv=3&cpp=klDYRLldU0qk2rg88I34eTVidx23n6yySedddrqDmu7Z4nn8MIu-1cuo8167O0HmgzXe-lbH1-XXESDYk0a06LZq6iAtZD7M2likGWYxaniItWy2bQ4psLcLmcukAEJoJrLD5Pn0CM2uVQjNsTf34CmtXPxMmhSeis8_LosvG3PWAGDWfKGobPLI6hcgokEUq7Ck_Ps18c5fTGuJVqJktXp1q4E4FsmlugxsVkLDGf626vDzgknEdlcbSLOiA1LwWG2QcDRJSxTu6Nu9&sds=2&rev=83599&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 24 Nov 2022 07:06:22 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame DF98 2 KB
1 KB 322ms
320ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame DF98 2 KB
1 KB 323ms
322ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 19 Nov 2023 07:06:23 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1D58 13 KB
5 KB 570ms
270ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 82562
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 23 Nov 2022 08:10:21 GMT
expires: Thu, 23 Nov 2023 08:10:21 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0011 783 B
1001 B 576ms
275ms Document
text/html 74.125.24.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8d94f91d2ca910fe2a82bbdf6f5eb55842c807a3f3d02244f13d826842b208bd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-p-3kDe49adyB4jLjmcM5Tg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-p-3kDe49adyB4jLjmcM5Tg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:23 GMT
expires: Thu, 24 Nov 2022 07:06:23 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6B79 13 KB
5 KB 572ms
270ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 82563
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 23 Nov 2022 08:10:21 GMT
expires: Thu, 23 Nov 2023 08:10:21 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 95F6 783 B
764 B 582ms
281ms Document
text/html 74.125.24.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

3b8d212b0ab38f830455643b6b7f6a08525e13778b389f9a297c63c84cfe7463

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ZBTIQakc9IfgEgUHxqqKxg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-ZBTIQakc9IfgEgUHxqqKxg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:24 GMT
expires: Thu, 24 Nov 2022 07:06:24 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 auctionData
e3.adpushup.com/AdPushupFeedbackWebService/feedback/aphb/ 70 B
317 B 238ms
237ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/aphb/auctionData?data=eyJzaXRlSWQiOjQyNzUzLCJ1cmwiOiJodHRwczovL3d3dy5iZzMuY28vYS9jaGVuLXNoaS16aG9uZy14dS16dW8temktamktbGluZy1odW4temh1LXJlbi1qaWFuZy1tby1hbi14aWFuZy14aW4tenVpLXpob25nLWd1YW5nLW1pbmcta2UteWktemhhbi1zaGVuZy1oZWktYW4uaHRtbCIsInNpdGVEb21haW4iOiJodHRwczovL2JnMy5jby8iLCJwYWdlR3JvdXAiOiJBUlRJQ0xFIiwicGFnZVZhcmlhdGlvbklkIjoiOTY3NTAxMjUtYjkwYy00OTdhLTg2OTktNzMxNzFmN2I0OTM1IiwicGFnZVZhcmlhdGlvbk5hbWUiOiJBZFB1c2h1cCIsInBhZ2VWYXJpYXRpb25UeXBlIjoxLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJwYWNrZXRJZCI6IjAwMDBBNzAxLTViZDU3NjFkLTkwZWYtNDAxNi1hZDJkLTUwOTNlZTE3MjkwNSIsInNlY3Rpb25zIjpbeyJzZWN0aW9uSWQiOiIxMDRiMjgyYS1iZDExLTRkOGQtYWQ2NC0wNDkyMDYzYjZjYmEiLCJzZWN0aW9uTmFtZSI6IkFQX0lfRF9BUlRJQ0xFXzEyMFg2MDBfMTA0YjIiLCJwbGFjZW1lbnQiOjEsInJlZnJlc2hDb3VudCI6MCwicHJlYmlkQXVjdGlvbklkIjoiNDdhOTEzMDUtYzcwYi00OTI0LTliZjgtZTkzNWZjNzdjMzcwIiwidGltZU9mQXVjdGlvbiI6MTY2OTI3MzU4MTcxMywiYmlkcyI6W10sInRpbWVkT3V0QmlkZGVycyI6W10sInJlcXVlc3RlZEZvcm1hdHMiOlsiZGlzcGxheSIsInZpZGVvIiwibmF0aXZlIl19LHsic2VjdGlvbklkIjoiZDFjMTBhNzItMjdiNC00OTMxLThjZTctOTlhMThlYmJkYmFlIiwic2VjdGlvbk5hbWUiOiJBUF9JX0RfQVJUSUNMRV83MjhYOTBfZDFjMTAiLCJwbGFjZW1lbnQiOjEsInJlZnJlc2hDb3VudCI6MCwicHJlYmlkQXVjdGlvbklkIjoiNDdhOTEzMDUtYzcwYi00OTI0LTliZjgtZTkzNWZjNzdjMzcwIiwidGltZU9mQXVjdGlvbiI6MTY2OTI3MzU4MTcxMywiYmlkcyI6W10sInRpbWVkT3V0QmlkZGVycyI6W10sInJlcXVlc3RlZEZvcm1hdHMiOlsiZGlzcGxheSIsInZpZGVvIiwibmF0aXZlIl19LHsic2VjdGlvbklkIjoiNzdhOWMyMmYtYWMwMi00NWRkLTk2YmMtYjA4OTZhOGE3ZDVhIiwic2VjdGlvbk5hbWUiOiJBUF9MX0RfQVJUSUNMRV83MjhYMjUwXzc3YTljIiwicGxhY2VtZW50IjoxLCJyZWZyZXNoQ291bnQiOjAsInByZWJpZEF1Y3Rpb25JZCI6IjQ3YTkxMzA1LWM3MGItNDkyNC05YmY4LWU5MzVmYzc3YzM3MCIsInRpbWVPZkF1Y3Rpb24iOjE2NjkyNzM1ODE3MTMsImJpZHMiOlt7ImNwbSI6MC4wMSwiYWRJZCI6Ijc0MDk1OTExZjUyMGNiNiIsIm9yaWdpbmFsQ3BtIjowLjAxLCJiaWRkZXIiOiJ0cmlwbGVsaWZ0IiwicmV2ZW51ZSI6MC4wMDAwMSwiZm9ybWF0VHlwZSI6ImJhbm5lciIsInJlc3BvbnNlVGltZSI6ODYxLCJ0aW1lT2ZCaWRSZWNlaXZlZCI6MTY2OTI3MzU4MjYyOH0seyJjcG0iOjAuMDEsImFkSWQiOiI3NTQ2MzJkMTJiZWJhMWIiLCJvcmlnaW5hbENwbSI6MC4wMSwiYmlkZGVyIjoidHJpcGxlbGlmdCIsInJldmVudWUiOjAuMDAwMDEsImZvcm1hdFR5cGUiOiJiYW5uZXIiLCJyZXNwb25zZVRpbWUiOjg2MywidGltZU9mQmlkUmVjZWl2ZWQiOjE2NjkyNzM1ODI2MzB9LHsiY3BtIjowLjAxMSwiYWRJZCI6Ijc2MDNjNzU2OTk1OTYzYyIsIm9yaWdpbmFsQ3BtIjowLjAxMSwiYmlkZGVyIjoidHJpcGxlbGlmdCIsInJldmVudWUiOjAuMDAwMDExLCJmb3JtYXRUeXBlIjoiYmFubmVyIiwicmVzcG9uc2VUaW1lIjo4NjQsInRpbWVPZkJpZFJlY2VpdmVkIjoxNjY5MjczNTgyNjMxfV0sInRpbWVkT3V0QmlkZGVycyI6W10sInJlcXVlc3RlZEZvcm1hdHMiOlsiZGlzcGxheSIsInZpZGVvIiwibmF0aXZlIl0sInByZWJpZFdpbm5lciI6InRyaXBsZWxpZnQiLCJwcmViaWRXaW5uZXJBZFVuaXRJZCI6Ijc2MDNjNzU2OTk1OTYzYyIsInByZWJpZFdpbm5lckNwbSI6MC4wMDAwMTF9XX0%3D&c_b=9250.199999809265
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:23 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ 107 B
165 B 574ms
273ms Script
application/javascript 142.251.12.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 274ms
273ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 51 KB
21 KB 737ms
737ms XHR
text/plain 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=683630719924987&correlator=949110565144859&output=ldjh&gdfp_req=1&vrg=2022111501&ptt=17&impl=fifs&iu_parts=103512698%3A22574853003%2C22477626096%2C22479095528%2C22579309510&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=320x50%7C728x250%7C728x90%7C690x90%7C690x250%7C675x90%7C675x250%7C670x90%7C670x250%7C650x90%7C650x250%7C650x150%7C630x90%7C630x250%7C602x100%7C600x90%7C600x250%7C580x90%7C570x90%7C550x150%7C468x60%7C320x50%7C320x100%7C300x50%7C300x100%7C300x75%7C300x250%7C250x250%7C200x200%2C320x50%7C728x90%7C690x90%7C675x90%7C670x90%7C650x90%7C630x90%7C600x90%7C580x90%7C570x90%7C468x60%7C320x50%7C300x50%7C300x75%2C320x50%7C120x600&fluid=height%2Cheight%2Cheight&ifi=1&adks=1420297610%2C2857874404%2C4082231052&sfv=1-0-40&prev_scp=adpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30%26hb_ap_format%3Dbanner%26hb_ap_pb%3D0.01%26hb_ap_adid%3D7603c756995963c%26hb_ap_bidder%3Dtriplelift%7Cadpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30%7Cadpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30&eri=1&cust_params=da%3Dadx%26outbrain%3Dtrue&sc=1&cookie=ID%3Dcb4b926012b6ff87-22a6a711a4d80089%3AT%3D1669273581%3ART%3D1669273581%3AS%3DALNI_MbmuEbZkoqtS27KVsYDbZDrjhsOZw&gpic=UID%3D00000b8252071b14%3AT%3D1669273581%3ART%3D1669273581%3AS%3DALNI_MZIsNNzE4cxmbrpXbKuxBWmoCmRtQ&arp=1&abxe=1&dt=1669273583877&lmt=1669273583&dlt=1669273576179&idt=5197&adxs=236%2C436%2C5&adys=60%2C1110%2C300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&frm=20&vis=1&psz=728x-1%7C728x-1%7C120x-1&msz=728x-1%7C728x-1%7C120x-1&fws=4%2C516%2C516&ohw=728%2C1600%2C1600&ga_vid=453263038.1669273584&ga_sid=1669273584&ga_hid=4016&ga_fc=false&ga_cid=amp-dscTJq3TkwNmxacwoleSYw

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b9754212d03564ba718c8eb5d9cef7f6bdb6759dbd0991ad541223a81ede4c62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21789
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 792E 6 KB
3 KB 281ms
276ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:24 GMT
expires: Fri, 24 Nov 2023 07:06:24 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0011 0
0 280ms
280ms Image
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022111501&jk=212154892497660&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 1D58 36 KB
16 KB 271ms
270ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 20 Nov 2022 20:43:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 296593
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 20 Nov 2023 20:43:11 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
106 B 572ms
270ms Ping
text/plain 172.217.194.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-Z0TZ7TDHS1&gtm=2oeb90&_p=4016&cid=453263038.1669273584&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1669273584&sct=1&seg=0&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fchen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html&dt=%E9%99%B3%E6%99%82%E4%B8%AD%E7%B1%B2%E3%80%8C%E5%81%9A%E8%87%AA%E5%B7%B1%E9%9D%88%E9%AD%82%E4%B8%BB%E4%BA%BA%E3%80%8D%E3%80%80%E8%94%A3%E8%90%AC%E5%AE%89%EF%BC%9A%E7%9B%B8%E4%BF%A1%E6%9C%80%E7%B5%82%E5%85%89%E6%98%8E%E5%8F%AF%E4%BB%A5%E6%88%B0%E5%8B%9D%E9%BB%91%E6%9A%97%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&en=link_preview&_fv=1&_ss=1&_ee=1&epn.value=1&epn.siteid=42753&ep.error_msg=no_mapping_success
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.194.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f138.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:24 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 95F6 0
0 272ms
271ms Image
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022111501&jk=3715708436332925&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 6B79 36 KB
16 KB 271ms
271ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 20 Nov 2022 20:43:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 296593
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 20 Nov 2023 20:43:11 GMT

POST
H2 200 all
csm.as.criteo.net/ Frame DF98 0
127 B 240ms
239ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 24 Nov 2022 07:06:23 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 img
pix.as.criteo.net/img/ Frame 7245 23 KB
23 KB 241ms
240ms Image
image/png 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

bb9338391e8fd82b612d7b68d8b3957b335090b5d94ef80df781105f1a706e1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:24 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=26428118
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23369
expires: Tue, 26 Sep 2023 04:15:03 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame DF98 23 KB
23 KB 269ms
269ms Image
image/png 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

bb9338391e8fd82b612d7b68d8b3957b335090b5d94ef80df781105f1a706e1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:24 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=26428118
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23369
expires: Tue, 26 Sep 2023 04:15:03 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 1D58 0
10 B 271ms
270ms Image
text/plain 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?HoAVvA
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:24 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 container.html Show response
1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame DD7D 6 KB
3 KB 578ms
276ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:25 GMT
expires: Fri, 24 Nov 2023 07:06:25 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C3D4 6 KB
3 KB 589ms
288ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:25 GMT
expires: Fri, 24 Nov 2023 07:06:25 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3EB8 6 KB
3 KB 594ms
293ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:25 GMT
expires: Fri, 24 Nov 2023 07:06:25 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame FA9B 16 KB
12 KB 290ms
289ms XHR
application/json 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221110&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_fy2021.js?bust=31070969

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9aca6071753bd4184e99e646692b3517988c35165d6e1b1a3017a65fe12c53b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12524
x-xss-protection: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 6B79 0
10 B 271ms
270ms Image
text/plain 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?sOJntw
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:24 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame B82B 16 KB
12 KB 289ms
288ms XHR
application/json 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221110&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d42d872dcb4744ad2b16ec5c688699271aa104ca45a2a84d9f742fe9b5812a1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12308
x-xss-protection: 0

GET
H2 200 publishertag.prebid.117.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 250ms
250ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.117.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

90c9017a8a6447588520f38cd94ba14cdb9839c92626aa06bb8a4a1052c2ab7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:24 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 29 Dec 2021 12:30:46 GMT
server: nginx
etag: W/"61cc54f6-15c19"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 25 Nov 2022 07:06:24 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 687D 42 B
64 B 298ms
298ms Fetch
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvoIa4yTxdbWE67t7QyDOFNdlnJIzkKR1vibYAdtJTMB96W5TGDDBIAR-3EdaMmSa2luBjboLfsnjGQ4HlDSVueRZYf&sig=Cg0ArKJSzPQIXCl77wryEAE&id=lidar2&mcvt=1000&p=0,0,280,336&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2365071409&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669273581016&rpt=2742&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame FA9B 17 KB
6 KB 274ms
273ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_fy2021.js?bust=31070969

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 07:06:25 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame B82B 17 KB
6 KB 273ms
272ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 07:06:25 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 271ms
271ms XHR
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.117.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

61c1317e433c125a2ebbbdaf22fc3a0b3606bcb0c9cfea151425adf7b5195f48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:25 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 24 Oct 2022 11:21:19 GMT
server: nginx
etag: W/"6356752f-16294"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 25 Nov 2022 07:06:25 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 5DBD 13 KB
5 KB 274ms
270ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 82564
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 23 Nov 2022 08:10:21 GMT
expires: Thu, 23 Nov 2023 08:10:21 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame DCC3 783 B
535 B 282ms
281ms Document
text/html 74.125.24.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

768f0f7e4d6c4062e79ad0d126c6313716c17632751f8fb97fab38859b075d78

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-FFAnzmG6ygLfVRsi3HQUgw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-FFAnzmG6ygLfVRsi3HQUgw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:25 GMT
expires: Thu, 24 Nov 2022 07:06:25 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame B375 624 B
242 B 282ms
282ms Document
text/html 74.125.24.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICENn9hYADGL2BgsgBMAE&v=APEucNU6mm97QpPzbSTLaAFOWEGMbJr4o175o-cW_Bd-aFSevuPXsgSVCkW1rSMYvopzjpZ80BM3EPptTdxWyR0DlF79ZWyZLg

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:25 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DD7D 15 KB
11 KB 309ms
309ms Script
text/javascript 74.125.24.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ax0iizWnsVKgkZ4dBduoldoJokXY8Iq3PF37Ze6XlyCCdOxbmyMWREK3eBGIBj4wfatRB4PMBI9hVEQVLOQbp-9uImNXNtJd-qgDPAEpB9tC6RAoOiFZR6Hp3eQ8WX18beQfCGLvZfJVsnHTeTfbP6gUrAf-M7f7VAht2ver_8fvB5xyQ&cry=1&dbm_d=AKAmf-BC7OVrXDM7VLjMovy62LtxiC6vnXPKOV468R4e546q_SqRDxK_6ftjZRf7Vi2u6Uy2H9291NprEvSPolIuUBPdU4S8ja7Ug1Z4Ii8hwyQYtJyENYhNofEbmWaavMVGUkTS7roUEcd56_ALTl62blrV3cmAE3--SA_XWUieDn7la2NLBtoCi5f0dY4tW9Co7BXTT6qaJc9FFjBCJe3uQuJVnLfX1zEWtXQY8w8kO3ev14edtZrNFlM3bqlJWr7OYW96g_9SfPRwqpXrX7FYe9k2UzR56rSr-16nzRhlrX4y1pCpWnBytiBuK_e5N37jMjVEDxNKuW1Qc0q08zgerTBbfQh0ld4x7AcQHHL2yE9IxKv68lahYRnaiBVoUDD_nn6qIOf242JXX3xH77JjBUf3GTKnZBVVdo1iUGgQ9jTBVSqIZBpnAJr-NVtINSg5wheI2jBEL4D4VyA03snO5ye2wXN4XukfyFwqEq5cn1XDG4PuadJ1PdfjbZCwt_tytYACUjF-RDqmNdtLIzRECP3xzbyV32M0FwD4S2zx6JKTAgOa8fM-SeAc3FgEC3LtqH7BDZDa4l3vshqbab8Zb7HeGxe5OqN6hQQPW2Mq5eh-Tp1xRk5POcd7eYztO8qD90LidvPS0RE1J2y3Iwy0MKTzRFSZBmSsHNNFemxERuM3EbWCW6u1rhw0NqJJFKYS1qfVkqcG88E9gRvM57bN3wo5DhXg2VBbDNomEKCTsxffn8gmipdTsONhSX3g9OwWXxReMZg0-hm8G0vbO80O9pwJhUKOGoM-h3BZIaAmox6fN-H6YwXpI20HYyrfx9nOLAMO4j8twk94ecWKDcn04QFYwVoQcckQF0rxeUVhv1QSYkDqmZ8DucVUlpX7b95nFBjwpBB2M1RfPWZt4Q7FJL02v9WPDaJH--__CU1k2NLhPb6GT_t92AxnyY-8fT7nrFSFJk1-2hpxhqrTZGJpGdScgcnB3KVvHaJ93zmdNNNAemewVSpjMt-2sgD_dOhtV9TgFoxN-uXiIxG-duokzFn8CfD-twSnxJ3tsV5KH_-71DaNYFK7etY7r4kIRgg31vpTcwqlQXuSkgRWOA8b8nAMnkGHZYP5FPUIwBuKP9x5LZSuVwIMBDI8f5j-TOqIh62GyIPz7N-B1_zV6ZLHz3JA4EQdhcpkkNFaA_cX25nabnLe-H6T3EGjNnwcpkrP0j7v-IGEsSi_4LGWfvrWct9P-tirvpCTPNluzH_QvFpZQUhM_DZu5tSaA8i0HnZ1ULTfSRL4FqLsXbXfBNSh28wLB8qi-9XHazP51QdNnCcY_N7YxK-xbcOAEjfYZcEt48vrlWWXj3JfDeHdHRzo33aoe11eWtSY_HEYDJZrQEZPN9VoCz2RDJEvA_riVswL8hJ4NtKGqaFNYIjCQhN2sPf_n1r-_5vYHaxLYYw1oEpShQHqiHsB_2CzDfEZHdb6KgFpsw_f20yK8puPIkhSRjlx1VobdURwrky9WLIwvf7F30ORYtVWESrgs7a5ttk3NhLHYZy4JIpo3K-P8QJ1cs3qV4I_pTXiUU0YfmGwVCfkuMWgh3rocFOPROsPEkhuDIrGwktU_jJEj6BCU3nKtDjCAkK-WP4PH0Av1n8heLBe4LHFl85sAsgmpoahFCveFd0sfXtfgo5xRZCQ2fIb5m0itRqdSmFO2RzvsMqs5kUqLpjasq6WuTBF38QuCS-Y7DrJVQz7lTB6D9UB3Ro4LxXguBGiTKfKB81ykwoLFp28CML8XGOjvrCTG52KEX3OoZ1dvKRYKPPctKl8qdB1fpjjKcjhCYbL167f71wYa1jyc2Adxlx5MUcL9MwGlm2dnip1cu8nXNPfsMVIbftiNpOP5vT6AJsSV2Ol194Ay9uyEesXmHqG-0NZ2zm7jgtf7eG3eUtqI3gFckE7Zj3Qu5FER-9XfEJEWOqoQfQlJcVfCfHIETrEYZu3Nid0k9upaiVgcrxu6gEu8b5uCYjMXRE7YeFOk-rss6Ey-4HpLXn-HLkG4mDzD2TNSyOvvjHp0T3VTklm1YDnFPXFfuzTaG6X5x6_77mcNekJ_9vINYpBPPSTSjuzRFqkTf6OFKv2L9EzwgSI1HlUbD279UOvmvIqQ4XQaVbn3a_iEL-JeLo58mZLlyNlw91UrFwgDWjBlPPeJy2D30IHCclQgLWfBDRVJ08ByKVY4D_NkniHw_dUjEBrAA2LwiwnsH5hlemBFekFLb_hG8PRS0Y5lzupbHfbTM6f_xrBdj4mtyRIR0LQQIBmd3GF_TPgs7PaxnhHDRVA1RsqaIJirIKaRnMhMXVuGIASuD53MHcoJR2aUFZUkkn3YIapniuzqazabnk9rSVzomtGr5L_0YOWm6UDhMYGCHKG5q5abIAgmSDH7xJN0XS-59C_vLbq6JADzGBNjI7TshNQPPzb8GiwQFBOiDAiaPjx6u1i8sE0JNgFLHS-XXRBeJ231AKI-AQ85h6RQQi3pAlAUB0YHJOknw6_F3Nafyk-vYvG1pRZxzU8aqscso5BW3CPRXmwu8u7WYBYjhzWJcJ0IfAyfNj0gINGQyy9PsWYyLRgBEysP7wxH_pkZgr_333am6k8HLG7EmGbBC-EDflXDC6hluzyQm6AmDW4Z6fFOs_Fa_-ymYBKQNIM24OtiCH8GVSh-KG7xVQ2MJVcO4HoK2-Yf3SHU85VgS0Uk-KjghCtd9HJM-7jJEgYaizbBKBu4U4YXsZD0DgDXR69xFUqJxFwatG-IpTCebzmq57qxd1S_dp7sHmBaGta5wqcFF87WH48W-pHwRaEBW5cWYN3ESjoaNbpewv_Tc572stbSFyyCeCfjiyK2eArQib6FLfkEIHNRIFzkOorh_ypxb9BnSuOuD-wVy9v4f1OyxYsrzSA-Tv3dKgij2zDEoMfPIUbyWkZTZI02wwSU01Ohh2mWmP9FIcUqVCIhSjaMDZfMGBkyr01KHAZDvJ81jZ4O3qoxDZseLFCqFI1faPlTApJuh8HrWt06y2QK2QQMa7E3azZDrrf3eTJmFvumvCLneZQlEAAFeEf9-EDVYRke9KQ-MX-RdWwaifInsUtcQRAeizcSt88HbdsBsMvPDRpsItPDcf8sFLRnzP4EqfpuCREKduhfHMCFjLZdQHIQX_OA8xJzadPYlLezyaPGDidrCYgSRFQyNaQ3CVPE5AhesCHFi6OO9r6lGxejB-kTP20rLbD4VBEftsjRWnibZhniTuRSFo0Fr9-pTeEqhWTqFVWoeirhpm2ZJiIgoF1cmKCl62AJTfIonuwyd2TGYSlO-V1Ts35mj5KOU2FseQgLzsmL_3Bq_YS8SUCx_CrgT-PmqC3Q5CqFSesCZKki6ymZAkla6TFEIjrdyPPIfm_oA4QXFHozuqQzAJ4-tV1fbCodQ&cid=CAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

908751fc3df5fb428bd13b301aaae9110e6b1bdcc30566206bcffbd14e86789d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11304
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DD7D 42 B
63 B 272ms
272ms Image
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AJedUlLNvIb6-3bUxuKSr-3wLKELmSmUbCII9R0GUPw27LO6DJBZwYjrE64Kfy6juCtBWBpgKBbGPHxyj3Iqu3384_3-z7Qf8fd89z-vLdFJDAR2s

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame DD7D 3 KB
1 KB 455ms
452ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 04:03:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10962
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Dec 2022 04:03:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame DD7D 18 KB
7 KB 298ms
295ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 16:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Dec 2022 16:21:12 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DD7D 0
0 325ms
322ms Image
text/html 74.125.24.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS4p_9lcmOMt--E_IaGOogIxYuDe2IMeIdtbpXZNT4F8AAlIz6XMbkLLQ7rdbym6en2xYuxa6q7xto0pGaR9wqVoeC32g
Requested by: Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f106.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DD7D 154 KB
47 KB 585ms
280ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 07:06:25 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame AD16 624 B
242 B 285ms
284ms Document
text/html 74.125.24.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGJ3e49kBMAE&v=APEucNUTVf0aOAxceX1Nsq8m2rI8ezZKkvJ5QNQt6yswUouT0RSLGg1-JZywR7QERfq-6BnhCC7VYtCE5x9NYADLtzwcGP6Tdg

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:25 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C3D4 67 KB
32 KB 357ms
355ms Script
text/javascript 74.125.24.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2oRYYnb2dF0b1cVJVDhbHBJHu2Qqmjmu3V-F7IIm4N2yfrD7EQQ5mqQPQQYVvNl0J2GcgTSWtkNp7FxbEBICM9X-gdg&cry=1&dbm_d=AKAmf-AKYqY6zBT826ZnBomS2nsXwH-NqzUnz-mjvngXvmT99yGEyeQENG5SbSrtgJpyGQ3Ws_S64awOkSHvdrEHjrl0AXs3j5Fek5tue6IhJVHTXaMCYyd4KeYiaBoRV7SAxRLKBfOI6DK2KDc3L8QH0INWIFhoXutj_ij0-Y96JmFOP_xrLZ_MKzpTT9t1Mq7tbmB1QafHPKQY1BulXdiRrHixTpkpmMFFIayXWIqCSwXtNnlZdBFjK39dLB64amB_NHtKqInqFw_uExC-m0hItAe5EtyMQvvWne1b_5COoM38md7O-loUpARMgC31Ap1c6S6TEr57ciRV8RPV5zz2RbrXCXUlmSWvZ7SEf5DAmjdiBOUOiTYazoRy4e5Tt6zkz8cd0kOXg4xXGvjpXfKYqtGAki5w3_Byk59CWDP82yFAxqZBt6ISaOgJSn8D8LV9Meh1zE7kqnpUyNzoRl8-AGRpBmSQATFOblsf82RFULYSndz13PMf-s6_5wN7XB064h87SiVlwaHdrriZuutv_SAv-vHf_ec1KC8aFI4UF5_wClGj-tA_pVzOf-FCoZrBd0xqnjs4lYcuuUPDNRQeNWC-nARrW5FQGYc3bYH_oBcwnaxEvzsgFpQ3Xb6ilasnyez5GJQlVjLwJ2mEjLHIJzx9HVP5TXFHZFrLBU9nZ0_7BkieCEjPod1DiD1asAl1poc05kiz9gD_4uikwlicYk0h9KS89rzxUGt7IJxOzjDsoPDdZ-p7jo47IqJC3xauDFjgcPQO2xOwVa3ytPQnKPGPUN5h1WtUAgALtE0dO8V8pFyGVp2O3dUJ1pWvjdb6T1XbYIhNxg_4ejGniOfNIi2Xb6BP9a3yEXinAxGSpORTMJiQ3K6d9pdkuScfBEi14dKW_BngwpNp2wXmK9Xdo3ylT4VdNLejQV7FvkDNM6KbcVl2IDm4HN18JvaO8cwothknQB5vHLwsWw_RB3pTPmtgQRegbZGDWYh3oa1FL4KdB6h8uRXTh2gkj7n9Ql5_ahWJdniRGzJ03nRHRevXGRHI_RV_OJNmkT4_QZqDQJ0b9UObkpjLaHHynDsxHVGvSg7nQtRHeg_OlmK9Wz7Kv471KR6mcvea3JQHJFjMMNR-9HWP2VqUUyF7_xMovJfw2xZYmaW47vuacAxqe26Q_KxnZOQCGnj5mXl9LM3pEzKg2sq80B6sV-5Q-wpidhM6EeQyjqBoxJvot0bDtfO9MTfuMrg_UYCuIxjeCsJQbaof2BPDZJug5vAjQVOvxo3_IXMYTBrSfxenEir5P2_Spor754fw2ROS0-WhHp7Zw6a0KQXU4H5gFww0C1GV8KgetcLQRbbknIHTDbLJ4k6-bajZaus85cXZs-yNG4W_B_YCmlhpKJp4fSIrwaLnS6iPbcUO-u2pvnGAjad3GvDQI0V3Oxk0LvVpIit9p8ayniAWBjnGtJ8XJi9Rak6JgJ8_RX9TXSdYQRgB5vFOLXUy2p0LCRjirP5uArtDNYl2Te2OxcJOjVETu9BcCy05Eah59A0IPIXVn4XSyFlY_lMso3CQt_V3TUwJjOyC6lhMg3DQw__fS3sSWcVMOZMVM3yXyQmxqYyvXrWynN3-dYE0TukYGFSQvHvzXy4GJKoRCQjmBhPsF2Iv6vhk6mSSO320IyvkrsZemmc06dcALydM9YcVCTC5olovpe7FHEpHIF1EtjfsWzSvTAFho0W7kuX_YbA-8PMawXnY3BhyXFgbxAzJSIa82zEr6agpT-GpKONl9oq-oIvwVKmEfXAudJ5AWm8jj-yW8v6ZRcPDUr2_QKsK7Skn3P6ghQCEhmQHUSuiBXXzFbwDzaVBxKecO46AbPmDxHd1Sx_SMwmvifEPfpyKE5lvDHMPzHOBs0m_fydJAfJ_DmwCtMRzC1kzJNd4oNYiBcJbZWMcisMFtO3K6xRUNiZyq25lML1jU-WVIqgqpPLb2RMye80Z_uROEODPKiHkH9uD5gC-yje1ZztniZ-RABP6vhgdq--bYZZG-gYyNEeX46ZFEAAlpYxcFMIYbyeJVWOiQ-8juJvXKnNGiccXlg3i-ltwTJiELLhf6Ls1o_1ELbcZymXB8fxG8-eu-s-_-fzXlk9EwRUxJ0BO5_FnPcQe-PgbfQtqorDbwia4ZXpZfGxut1NYB75HJ0IYPGFBqgSqnI8y5yVZXvRkQLT3JlEh5Ji8XCFfQk-4tfybOZ7MwFHlBfwvXR3LvZ2kQ9mgNgjhMO_LSbjrmfO6TTI3XXt_EgWqELWCB0jdZzFImzAhq_l30pr8_otMAMkkl7R3Q4GNO6w03KAo1WmbAwPtTYVqD96yzs5QOj2X7j9_aASxsLJKgN8DBRr7cIbCfjLyA5yaCI9BmM73tJi2L2mpIRDphYlU8fiSGdiD08f6Gzu3W511RpK6DwFnWzZ296BCVfhyCLp93yd5FPKvd61o_EijJnNfRQ6beHO-Kts6z5WrjbiV2usQpLPBvvOq0luSxPOoFRYpyzgZtvSF9LWOHFge8W--gl465jfeQjOQ16hgxBlhYkO8cwwHitNmy1Vx3xx3s33MXhwjvyOwSR5MRWY_RPQKiuiBxEVfRyV09rL_T7tzVFnliEq0UXyiZ1jmki1VZtsEyPYBHTifZjLyJRAX9f1aYPE0TB8qf9F0YCFVBDPY3s_IEKnUWlSU0kFsaTnHFnFVIfMxCqItZrG_swXEQkVM-jxg_nI-yPia4qBsz0tz007_pt7rSL9FlxkF3dbdkUxAdOphr7432J03vFK17ieA1ND7ORq-0LfoRjB0zMG2gbKjWyaDnkyGnUaMhHhuulPmSkdDq6ktL4tBTe3oQXXTg4jgJDLpgu194Y8TQCP4nfCCgM-WT2w1kfvcrW2Y5LIVh7hyYLrbz0kj25AqOGm9mFgRFI3Q0Qyj3ao1XONsDddtzHAiS8lEpK3ULwHhAQ-Xs18Dhn34qVPdbc24CrJzgSNP4W7Iwj5Ww3kVHjiYHwcJ4mnLvi8ENhahLcvYv71TwIQl7WqSbWvJE2DYy_13wpW0-To0Pf533i9cVMVs9bubmD_j7mKiNB4_YYAHlmqXPZKDRmkVzDqKsn30JdKxAfJBQvQbQN_AOap5ZeY57bvIM4gH0uyIjs_tiZa0ePMLMarzOEtj90tYY0uXOCIglsv_f7FspFeTGQi-Sy-dKnajYB404O3olrVjZbcVGTJfHQUVlQKmPtRWk5c7xGzuVKexhzFL5c5isl3WH6H9-CXAxyus6AIWeqNx96Fl6UvdzF8h2x9cYDdpQARbn0hPWmXSr8a9YGogXeUfyZMWDzBiL_KOSaJv0TYDKa11&cid=CAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5c2cc315f06d25df910011a384645c410163f58fecb57be3ea0901551e01adf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32975
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C3D4 42 B
63 B 274ms
272ms Image
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BYpezVZwh4fcy1kKXq8OkIN4-sd5qYkBy-3sqvpivG4gnyJ5bFmiryhSGfOnblM4RBJhp4z15A0YiW5R-mcHfNlk44MqzLSYqlpS8nAIfftFdQ5yI

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame C3D4 3 KB
1 KB 451ms
448ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 04:03:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10962
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Dec 2022 04:03:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame C3D4 18 KB
7 KB 321ms
319ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 16:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Dec 2022 16:21:12 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C3D4 0
0 325ms
323ms Image
text/html 74.125.24.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTISq2bYZ7MdUR047nyLDaYXdnmuwCR6YRWTtCqKHNFf42JZZwJiPfGXOM9E6IPcuBo30r4yQ8kAtTt3EHTlPiMAK5USQ
Requested by: Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f106.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C3D4 154 KB
47 KB 647ms
344ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 07:06:25 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C3D4 0
20 B 273ms
273ms Ping
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=jca&jc=75&version=r20221110&sample=0.01

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A607 640 B
262 B 282ms
281ms Document
text/html 74.125.24.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGInHgtoBMAE&v=APEucNVvGVhkwfuPXEh8dwyVELAGiyauLDsx4vBtKw4UaQUiT-8YzBJmB6BBKnACHkiG3D7xgoBDGAeff8Bmec8h9yREaJ_vbQ

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:25 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 3EB8 76 KB
27 KB 288ms
285ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def1424f4f259a4cf927fe1f7ea7ec24bdc2fc78edca55fdb593cc0c293dbec5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27387
x-xss-protection: 0
server: cafe
etag: 15442950961169408521
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 07:06:25 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3EB8 42 B
63 B 275ms
272ms Image
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ai5oH8ePkZSKG-jshbBPuM0kFlULNCIjgh4vRnjo-WJZGmTvX1qAjauvKAs9UXJafR7cdoTb341UEYMK4BwwhSDtYanNI8tWlwSWW3xc25UkhYWd8

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3EB8 0
20 B 277ms
273ms Image
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=12381268080485554492&x=1&ct=76

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 3EB8 3 KB
1 KB 451ms
448ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 04:03:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10962
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Dec 2022 04:03:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 3EB8 18 KB
7 KB 357ms
355ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 16:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Dec 2022 16:21:12 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 3EB8 0
0 328ms
326ms Image
text/html 74.125.24.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS5Xriir0-xJukwt21l2L8zqtITxJD5-Njte6_JSUnUCBfnCzECjUgkUYh502h8u5MpYJQzEo5tVJ5g2JV21jf2WPcMvw
Requested by: Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f106.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3EB8 154 KB
47 KB 720ms
418ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 07:06:25 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3EB8 0
20 B 274ms
272ms Image
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=dbg&cor=12381268080485554492&x=1&ct=76&dl=0&ds=0

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame C8FF 13 KB
5 KB 280ms
278ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 82564
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 23 Nov 2022 08:10:21 GMT
expires: Thu, 23 Nov 2023 08:10:21 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6268 783 B
534 B 282ms
281ms Document
text/html 74.125.24.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

875d1e22a23d4699d723bdeafe3a46e3e388019d5ae3d2ff247e8bdba65716db

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--BaZrk_fod93hi30J3IzXg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce--BaZrk_fod93hi30J3IzXg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 24 Nov 2022 07:06:25 GMT
expires: Thu, 24 Nov 2022 07:06:25 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame B375
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&C=1

43 B
766 B

338ms
337ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICENn9hYADGL2BgsgBMAE&v=APEucNU6mm97QpPzbSTLaAFOWEGMbJr4o175o-cW_Bd-aFSevuPXsgSVCkW1rSMYvopzjpZ80BM3EPptTdxWyR0DlF79ZWyZLg
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:26 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame B375
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y38X8hnOKF0xinZi.X5T0QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&google_hm=2

43 B
766 B

338ms
337ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICENn9hYADGL2BgsgBMAE&v=APEucNU6mm97QpPzbSTLaAFOWEGMbJr4o175o-cW_Bd-aFSevuPXsgSVCkW1rSMYvopzjpZ80BM3EPptTdxWyR0DlF79ZWyZLg
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame B375
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEClQnJig8h-hbJX1hWR875I&google_cver=1

43 B
1016 B

401ms
335ms

Image
image/gif

68.67.179.155
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEClQnJig8h-hbJX1hWR875I&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICENn9hYADGL2BgsgBMAE&v=APEucNU6mm97QpPzbSTLaAFOWEGMbJr4o175o-cW_Bd-aFSevuPXsgSVCkW1rSMYvopzjpZ80BM3EPptTdxWyR0DlF79ZWyZLg

Protocol

HTTP/1.1

Server

68.67.179.155 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:26 GMT
AN-X-Request-Uuid: b65f96a1-22d3-465e-b253-ba9b0b8d1736
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEClQnJig8h-hbJX1hWR875I&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B375
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3NjUzMjE4Mjg4NDE4ODIyMA%3D%3D

170 B
188 B

274ms
273ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3NjUzMjE4Mjg4NDE4ODIyMA%3D%3D

Requested by

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:25 GMT
AN-X-Request-Uuid: eb0ab412-f73c-41a9-a908-e45a8790a2bd
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3NjUzMjE4Mjg4NDE4ODIyMA%3D%3D
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame DCC3 0
0 273ms
271ms Image
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221110&jk=1162199652779195&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 5DBD 36 KB
16 KB 273ms
271ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 20 Nov 2022 20:43:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 296594
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 20 Nov 2023 20:43:11 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame AD16
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&C=1

43 B
766 B

357ms
351ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGJ3e49kBMAE&v=APEucNUTVf0aOAxceX1Nsq8m2rI8ezZKkvJ5QNQt6yswUouT0RSLGg1-JZywR7QERfq-6BnhCC7VYtCE5x9NYADLtzwcGP6Tdg
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:26 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame AD16
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y38X8hnOKF0xinZi.X5T0QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&google_hm=2

43 B
894 B

353ms
352ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGJ3e49kBMAE&v=APEucNUTVf0aOAxceX1Nsq8m2rI8ezZKkvJ5QNQt6yswUouT0RSLGg1-JZywR7QERfq-6BnhCC7VYtCE5x9NYADLtzwcGP6Tdg
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPMKIrQTl5AqrWBQsO1D6Kk&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame AD16
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEClQnJig8h-hbJX1hWR875I&google_cver=1

43 B
1016 B

415ms
342ms

Image
image/gif

68.67.179.155
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEClQnJig8h-hbJX1hWR875I&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGJ3e49kBMAE&v=APEucNUTVf0aOAxceX1Nsq8m2rI8ezZKkvJ5QNQt6yswUouT0RSLGg1-JZywR7QERfq-6BnhCC7VYtCE5x9NYADLtzwcGP6Tdg

Protocol

HTTP/1.1

Server

68.67.179.155 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:26 GMT
AN-X-Request-Uuid: 3a940dfb-b596-4228-9bd7-d5c518d4a8ba
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEClQnJig8h-hbJX1hWR875I&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AD16
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3NjUzMjE4Mjg4NDE4ODIyMA%3D%3D

170 B
188 B

277ms
275ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3NjUzMjE4Mjg4NDE4ODIyMA%3D%3D

Requested by

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:25 GMT
AN-X-Request-Uuid: 2937af06-71ef-40bb-a8b6-a7c43a792b1d
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3NjUzMjE4Mjg4NDE4ODIyMA%3D%3D
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame A607
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBw9JYR-CbVQYbNOiEdaqGU&google_cver=1

43 B
61 B

383ms
237ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBw9JYR-CbVQYbNOiEdaqGU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGInHgtoBMAE&v=APEucNVvGVhkwfuPXEh8dwyVELAGiyauLDsx4vBtKw4UaQUiT-8YzBJmB6BBKnACHkiG3D7xgoBDGAeff8Bmec8h9yREaJ_vbQ
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:26 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBw9JYR-CbVQYbNOiEdaqGU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A607
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YmU2ZDI4MDYtM2E5NS0yMDM0LWUyNWMtMjJkNzQ4YTcyZTg3

170 B
188 B

274ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YmU2ZDI4MDYtM2E5NS0yMDM0LWUyNWMtMjJkNzQ4YTcyZTg3

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGInHgtoBMAE&v=APEucNVvGVhkwfuPXEh8dwyVELAGiyauLDsx4vBtKw4UaQUiT-8YzBJmB6BBKnACHkiG3D7xgoBDGAeff8Bmec8h9yREaJ_vbQ

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 24 Nov 2022 07:06:25 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YmU2ZDI4MDYtM2E5NS0yMDM0LWUyNWMtMjJkNzQ4YTcyZTg3
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame A607
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESENGCVZVHR5-dd1tu-W-hZCI&google_cver=1

23 B
172 B

773ms
316ms

Image
image/gif

23.53.160.138
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESENGCVZVHR5-dd1tu-W-hZCI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGInHgtoBMAE&v=APEucNVvGVhkwfuPXEh8dwyVELAGiyauLDsx4vBtKw4UaQUiT-8YzBJmB6BBKnACHkiG3D7xgoBDGAeff8Bmec8h9yREaJ_vbQ
Protocol: H2
Server: 23.53.160.138 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-53-160-138.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

expires: Thu, 24 Nov 2022 07:06:26 GMT
pragma: no-cache
date: Thu, 24 Nov 2022 07:06:26 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESENGCVZVHR5-dd1tu-W-hZCI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A607
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NGFjMTkxYWEtYmVkYS00M2YxLWJkZjAtNzFhOTVkMzY4ZjRh

170 B
188 B

274ms
273ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NGFjMTkxYWEtYmVkYS00M2YxLWJkZjAtNzFhOTVkMzY4ZjRh

Requested by

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:26 GMT
server: akka-http/10.2.9
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NGFjMTkxYWEtYmVkYS00M2YxLWJkZjAtNzFhOTVkMzY4ZjRh
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Thu, 24 Nov 2022 07:06:26 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3EB8 0
20 B 272ms
271ms Ping
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9963024152063&version=m202209210101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3EB8 0
20 B 272ms
272ms Ping
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9963024152063&version=m202209210101&ct=76&x=1&cor=12381268080485554000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3EB8 67 KB
32 KB 332ms
331ms Script
text/javascript 74.125.24.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BK-FKRA8N3XLjLLUpkQztOGXwsal3h1EGLrSP8jHFVSlxEYFqzpZdnpPVBK6iAGeLWVHR_Yz6rnZdLvO2SKvXYlzWG7Q&cry=1&dbm_d=AKAmf-CLpzNGwCwTECEx9JoF6tr3IcltMzoLm9Q_82IsTBPq1Hc4Nr9eCZyoBhVEhLkkdxPNiSXHhXDOoTP_MXpJi2j7rQGzcMHrRpU4tGPIjs86cCrjL9zn7dFXQXvHdQQ3giKgbGzUeN48iSc2KOV7HOssYChD4ki5yo6Y_dJfZnTKdxNSteLQU5MAwcf_9jQzwtu4ZswScJRJ6sE_UqXEdm5194KN6b2ndjclCbMYWEqvKW8rKNQZ1xqwbqJQAW9pqZQDPmOPwrKti7bL4uQmQ3gtlahWMY6p5-f4QYQtgRplYXVbLGnPhSzFxHCF-8G8dXKrtIRc4xZcwUnJFZk7-D9C452ZMw9phdSbdFa_XevpRgxUC4ZwQkUrMEwT79xShGj9KVHli1HoEtZZzRGrr6xtlQJ6EjKxG_IwrvnY-Xg4kgxLfu9I34QMeUbDJWeY203iQqwJiCxdEPMujQDDCe8mYWejuruu6m-qR7-b4VZEqcDkxCe57aJtC0RXduhzz31DT20zQl8Ubm9I65jHJvWTy--KcxBn5X7EkjCOklybdI4EW0io95dosNJMJQ3MXK8watKFP5RJ7-LviApP0EIZii_8KNosXwP9TS9my1qwWcz6txMj7qtKN7RhBFGESdyE_YkUovVy0sWywHOVM6cvuG5x3XHgDbQQlOr7nE1r_FHq0FMjCoDiZuKosGb8VQQdzx7jxH_bzx21-GO0NVIPetM5LDKtpr3anhNiXYFSNW2n16b7QkaAh1Gn9CKZbDPHMjRcdNlH064yWImUOGLqk_qZE8ytbKKkWHGOvNW79tbqw3cuZ_v8_eww_-M6zmy_AXGefrscIIgbwxGSWz1x3t_glSEqVVZ1AwDqn_EvUVMzoxEdMKGDl2HH3Hj30yp0_lJmJVADKHZyBqeixl_e2FLFqRKgPCZWoUJOEwf7m3IRm3wAv2nX0_ZT3pE8fsUKMBWTtwsK-YoBM_DYbeA7Yo0eXrJKUe7YgNtYtNSkcgvc-0kVLrvY22U0JmA4orO-kWicq-43QzyPlkMj1U3YuSI36Ak1FlJ_q6_MoOXyTUDD8iP2gRej4mI2jiBf_jw9LDwraPRNBcY5sZbAwqZXxMYe4duHqOvIOCmjhD1u8BgeUTD5Fmb-aEeE39f1Ylo7a2m4cT2n-_5CVB7m2YEWcByW0wGjZL1pY55PEQDlS4jcfgsiWZNQijU5yAWCZxhblnMvaYNXSFieqTDwEgtUNgHHIvuTNAMFFlVvnEry9c0cJ-XEaMugAgV7ejSmXIBz5AHwLmw39Q-xQGAFDSh29exDUTAGpA0ED3_WzhSqktvpbTWQx5dJX7vCAp233_prjX_zZ0OanWXMhc2jN60RI9i199DHzoe5Z8ckt2hbW8ly2eOSaUrXGWLJQDwrBxTJwOKfCJVFETH7scYx_Y1wMGB0vA9ph2UelxuYxgatnlLajsNgNE-hmyrN9H-2XAhGYOCQ_Me5sScxkwwvEnV_uzbmuNBzYlzCpa1MQKQjxRxYT_TUDPiqd2t16cTiJwqGCz9vKDu11iugqqT0pOWToStNc8ayUGx_dbbgiHDKF2EkxpfsMhduW2KzeIs7__KeeOIoTa2CBXtsuiSKndNiqn4O0kDybuSDj07ckc0JHN6eTZatOtxdpo5b2Lx2HDGPZUa0_JN2lqTSrEXnZxEt5M5qg6YQM-OcSRNyewKGY-UxyCKW3hWlhcadqPr5Osod0PoyZ63nhX2IhrQAVjTj4eF40NvnsQLFv3l1N59cbNszMSLmFNq0fllSV9vHjfwNSVgK24i-S115Q8LaJJB9957eC-EinEUyiGRWg7ad5-7nYvfvoB7j7hk6U7U2YxfaYfp8uBVAUz2-A-d91n7Wrkqd8Hqbe2NOIl366WotCS6Fp4pGQdnlQA_5viTxWPOIyO1QZf0HU1o-AM78wmowMj7Taf6aCVxp6ses86_U3GmJLo99RCUC0h2p9eMM_Wckcuk8vg7dzIuKjoH7cO6nQpWOKhsX86p_fRcMW45ad9W2X6jZ8fHf7oGKwZg8UIQzd4LdnsZu8xjFOJdBQnv6etjVTEdQX8mwDsJp3GPypLVcvqU1RtMKcE9UJOnnnRf3f6_PLYQmiON-QinZuqQXl5LI8_75wEadTgEVUuoHumGQy9zmV7KnpeSPX-PDhcGjHJ6bCli1-eVyuVuVsj7o6uGkKGfxrG__b4kWF0nIKrt5_NwypWi9l9t3eNvy6kzbinrgs2b2gM8tnQdE3xRBd6qbVzmXPGjM7w50Ir_md3-B1FqkQCgZ5Rk2dLaJ-GUjHDChK-vtrYVYDa04aaMEO9Jk89rqQP3HVYRulAfenRERaBX6nQG2F91uNHGla__2ZJpXHGF0n0GazC4dcSSbo9-51UqOiRx08VjcgaBA7r9IB4k3B8pY2lSOvaBws5ekzqayO7ufx5hV0MPk4HhICFKmMk6vKO9ztBR7U_XVQ69qBMsIbVil1IYdZctipR8mkKkrcZhNREVrjLD6qpuneoC5Ur2sAczROjYKv_uJeLJfeiKVC17K023EvRZMz-3rsL_2M_gYf2EUwUNhRW6E7VJq494fokKLAOxRGo825Bg3U8Vnk8YDFWsBCCaEhV-oyRzA96B7_AEdV99LJofuVUVVes0S4jVe2YnghcktHCRecEfZjc_3g4WJlwUT1bTRNpj0LZmPWuLCf9H8Fb-PAGmJFMM8mQNcKlGl1DR8NfnPqOxmbYKjmoj5uKqUny20D6NllCF2kmn8ZvjKPMNRLErEPBzlhW2hvFRt2Or1tupP6NuC1fBGviNGqdfSsC-bwoAFBe16oqLbAotes4tKEPJexguMIYBq0eeMp3DQlMT5huf_hbkBmMNkvsS55gbq4WuTZN5fv5d_7M2eMpsm7XbU0MtOPRZNzaSu2BUAMS7tZaSsSlldusCT1L4wv2WwDmKBZ3O3ESjWRhlGWCl3oNJufyzOWGzzXq_sJHBgmWIFz3wHfPtK6x9c7P3UgfJo3yxsOoh0Yb6toP17oXwrqsqTow8UzLwYuuj9yUB9RJe3B6ibFYUwwkEolX5o5JT1ySLIcOrugd_eLDmiD5wfwOpiVyEDFn5ZUEyIsq1yWxbgZZSsf1XGA0miQ7-GdrkqDQK33c6iJgLeRyromrXPw_JTxEhEAN1Nt7tCq6SLXOj90QMom7gV4LSNIr8PJ9r7POZXMqVJ3P_7C2yRMlpOIvxncTPgRy74u92rZo47p5Mw4ZlrdsN6VsNc9LDqh4OEv_EEiPpdJSlGBUhCA704Ux5y-oZWURgoNt-cKlW1tPHShdYywjcyTsWB0IW9-V3_rdfn&cid=CAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM&dv3_ver=m202209210101&rfl=https%3A%2F%2Fwww.bg3.co%2F&ds=l&xdt=1&iif=1&cor=12381268080485554000&adk=2857193498&idt=329&cac=0&dtd=10

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9561585a9f86828410f376bfb1f0c475dbbbbba7a9e2e2e7992d0a53e7884861

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33078
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame DD7D 41 KB
15 KB 270ms
270ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ax0iizWnsVKgkZ4dBduoldoJokXY8Iq3PF37Ze6XlyCCdOxbmyMWREK3eBGIBj4wfatRB4PMBI9hVEQVLOQbp-9uImNXNtJd-qgDPAEpB9tC6RAoOiFZR6Hp3eQ8WX18beQfCGLvZfJVsnHTeTfbP6gUrAf-M7f7VAht2ver_8fvB5xyQ&cry=1&dbm_d=AKAmf-BC7OVrXDM7VLjMovy62LtxiC6vnXPKOV468R4e546q_SqRDxK_6ftjZRf7Vi2u6Uy2H9291NprEvSPolIuUBPdU4S8ja7Ug1Z4Ii8hwyQYtJyENYhNofEbmWaavMVGUkTS7roUEcd56_ALTl62blrV3cmAE3--SA_XWUieDn7la2NLBtoCi5f0dY4tW9Co7BXTT6qaJc9FFjBCJe3uQuJVnLfX1zEWtXQY8w8kO3ev14edtZrNFlM3bqlJWr7OYW96g_9SfPRwqpXrX7FYe9k2UzR56rSr-16nzRhlrX4y1pCpWnBytiBuK_e5N37jMjVEDxNKuW1Qc0q08zgerTBbfQh0ld4x7AcQHHL2yE9IxKv68lahYRnaiBVoUDD_nn6qIOf242JXX3xH77JjBUf3GTKnZBVVdo1iUGgQ9jTBVSqIZBpnAJr-NVtINSg5wheI2jBEL4D4VyA03snO5ye2wXN4XukfyFwqEq5cn1XDG4PuadJ1PdfjbZCwt_tytYACUjF-RDqmNdtLIzRECP3xzbyV32M0FwD4S2zx6JKTAgOa8fM-SeAc3FgEC3LtqH7BDZDa4l3vshqbab8Zb7HeGxe5OqN6hQQPW2Mq5eh-Tp1xRk5POcd7eYztO8qD90LidvPS0RE1J2y3Iwy0MKTzRFSZBmSsHNNFemxERuM3EbWCW6u1rhw0NqJJFKYS1qfVkqcG88E9gRvM57bN3wo5DhXg2VBbDNomEKCTsxffn8gmipdTsONhSX3g9OwWXxReMZg0-hm8G0vbO80O9pwJhUKOGoM-h3BZIaAmox6fN-H6YwXpI20HYyrfx9nOLAMO4j8twk94ecWKDcn04QFYwVoQcckQF0rxeUVhv1QSYkDqmZ8DucVUlpX7b95nFBjwpBB2M1RfPWZt4Q7FJL02v9WPDaJH--__CU1k2NLhPb6GT_t92AxnyY-8fT7nrFSFJk1-2hpxhqrTZGJpGdScgcnB3KVvHaJ93zmdNNNAemewVSpjMt-2sgD_dOhtV9TgFoxN-uXiIxG-duokzFn8CfD-twSnxJ3tsV5KH_-71DaNYFK7etY7r4kIRgg31vpTcwqlQXuSkgRWOA8b8nAMnkGHZYP5FPUIwBuKP9x5LZSuVwIMBDI8f5j-TOqIh62GyIPz7N-B1_zV6ZLHz3JA4EQdhcpkkNFaA_cX25nabnLe-H6T3EGjNnwcpkrP0j7v-IGEsSi_4LGWfvrWct9P-tirvpCTPNluzH_QvFpZQUhM_DZu5tSaA8i0HnZ1ULTfSRL4FqLsXbXfBNSh28wLB8qi-9XHazP51QdNnCcY_N7YxK-xbcOAEjfYZcEt48vrlWWXj3JfDeHdHRzo33aoe11eWtSY_HEYDJZrQEZPN9VoCz2RDJEvA_riVswL8hJ4NtKGqaFNYIjCQhN2sPf_n1r-_5vYHaxLYYw1oEpShQHqiHsB_2CzDfEZHdb6KgFpsw_f20yK8puPIkhSRjlx1VobdURwrky9WLIwvf7F30ORYtVWESrgs7a5ttk3NhLHYZy4JIpo3K-P8QJ1cs3qV4I_pTXiUU0YfmGwVCfkuMWgh3rocFOPROsPEkhuDIrGwktU_jJEj6BCU3nKtDjCAkK-WP4PH0Av1n8heLBe4LHFl85sAsgmpoahFCveFd0sfXtfgo5xRZCQ2fIb5m0itRqdSmFO2RzvsMqs5kUqLpjasq6WuTBF38QuCS-Y7DrJVQz7lTB6D9UB3Ro4LxXguBGiTKfKB81ykwoLFp28CML8XGOjvrCTG52KEX3OoZ1dvKRYKPPctKl8qdB1fpjjKcjhCYbL167f71wYa1jyc2Adxlx5MUcL9MwGlm2dnip1cu8nXNPfsMVIbftiNpOP5vT6AJsSV2Ol194Ay9uyEesXmHqG-0NZ2zm7jgtf7eG3eUtqI3gFckE7Zj3Qu5FER-9XfEJEWOqoQfQlJcVfCfHIETrEYZu3Nid0k9upaiVgcrxu6gEu8b5uCYjMXRE7YeFOk-rss6Ey-4HpLXn-HLkG4mDzD2TNSyOvvjHp0T3VTklm1YDnFPXFfuzTaG6X5x6_77mcNekJ_9vINYpBPPSTSjuzRFqkTf6OFKv2L9EzwgSI1HlUbD279UOvmvIqQ4XQaVbn3a_iEL-JeLo58mZLlyNlw91UrFwgDWjBlPPeJy2D30IHCclQgLWfBDRVJ08ByKVY4D_NkniHw_dUjEBrAA2LwiwnsH5hlemBFekFLb_hG8PRS0Y5lzupbHfbTM6f_xrBdj4mtyRIR0LQQIBmd3GF_TPgs7PaxnhHDRVA1RsqaIJirIKaRnMhMXVuGIASuD53MHcoJR2aUFZUkkn3YIapniuzqazabnk9rSVzomtGr5L_0YOWm6UDhMYGCHKG5q5abIAgmSDH7xJN0XS-59C_vLbq6JADzGBNjI7TshNQPPzb8GiwQFBOiDAiaPjx6u1i8sE0JNgFLHS-XXRBeJ231AKI-AQ85h6RQQi3pAlAUB0YHJOknw6_F3Nafyk-vYvG1pRZxzU8aqscso5BW3CPRXmwu8u7WYBYjhzWJcJ0IfAyfNj0gINGQyy9PsWYyLRgBEysP7wxH_pkZgr_333am6k8HLG7EmGbBC-EDflXDC6hluzyQm6AmDW4Z6fFOs_Fa_-ymYBKQNIM24OtiCH8GVSh-KG7xVQ2MJVcO4HoK2-Yf3SHU85VgS0Uk-KjghCtd9HJM-7jJEgYaizbBKBu4U4YXsZD0DgDXR69xFUqJxFwatG-IpTCebzmq57qxd1S_dp7sHmBaGta5wqcFF87WH48W-pHwRaEBW5cWYN3ESjoaNbpewv_Tc572stbSFyyCeCfjiyK2eArQib6FLfkEIHNRIFzkOorh_ypxb9BnSuOuD-wVy9v4f1OyxYsrzSA-Tv3dKgij2zDEoMfPIUbyWkZTZI02wwSU01Ohh2mWmP9FIcUqVCIhSjaMDZfMGBkyr01KHAZDvJ81jZ4O3qoxDZseLFCqFI1faPlTApJuh8HrWt06y2QK2QQMa7E3azZDrrf3eTJmFvumvCLneZQlEAAFeEf9-EDVYRke9KQ-MX-RdWwaifInsUtcQRAeizcSt88HbdsBsMvPDRpsItPDcf8sFLRnzP4EqfpuCREKduhfHMCFjLZdQHIQX_OA8xJzadPYlLezyaPGDidrCYgSRFQyNaQ3CVPE5AhesCHFi6OO9r6lGxejB-kTP20rLbD4VBEftsjRWnibZhniTuRSFo0Fr9-pTeEqhWTqFVWoeirhpm2ZJiIgoF1cmKCl62AJTfIonuwyd2TGYSlO-V1Ts35mj5KOU2FseQgLzsmL_3Bq_YS8SUCx_CrgT-PmqC3Q5CqFSesCZKki6ymZAkla6TFEIjrdyPPIfm_oA4QXFHozuqQzAJ4-tV1fbCodQ&cid=CAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 22:07:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 118717
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Nov 2023 22:07:48 GMT

GET
H/1.1 200
OK frm Show response
www.adtrek.co/adserver/ Frame 8148 26 KB
26 KB 739ms
290ms Document
text/html 3.104.150.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCGkqp8Bd_Y9GzBfaT1AaQ756ID5jKk7Rtip7hvYYQzdXD_NAqEAEguoTAM2Cr7LGF4BigAeDUsp4oyAEJqQL7fHTV8wGlPqgDAaoE3gFP0Ba7shq4axU4xrgATM7MbtJJ0KfVUCEvdtmO7IkRwG9g1otlYiLpz9M25fXOGvdzWwo_ajtWSfRU4ayhoAH_vVSenAlkm93l_GwERHIho_9wl93wJjSOa3EFmWfPjVmmCZxM3tu6oL8pJOIX9zZeyTzpFSvGy7hEsZv9ac26F5ZSoLhLI5QfKHqTI2mkigNp9J02KcnNuqOZfLWYtK8NKTbipXtnj2J3tIhJ0XPg8iih3dU9uejA6XvZllVBT9HONkTEj2EGAUf3dCYqEkW-yl-QaKMcVsyP6ExU637ABJSMxeXmA-AEA5AGAaAGTYAH4IyD_gKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIBhEAEYHTICigI6AoBA8ggbYWR4LXN1YnN5bi01MjM5OTM4MjEzODcwMzgwgAoDmAsByAsBgAwBsBPVjZwRyBPD8OfeA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM%26sig%3DAOD64_3t_pHiCp2ke2t00mpSY-ONLUvwFA%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-BT-0ZhcVt_dmLUxC677Qbm2UOdd3aIT-5U7x2bZ2wJctFUOEL3EqnV7PjR3gggyxIHb9ThiCRg_eC_zhEKvLZSHQnVbZbjjrXSV0qgokimWYfXXY81ahoK6CQugx2Jwlwl_pfebvxkGzGR3wutoCRFsWKWDCRC4HRhEPdEHsPTxJOgLvk%26cry%3D1%26dbm_d%3DAKAmf-ANMVvCcIIAAQE-Ws1JrRn6Z2_JzTIXhAoywPEM3JSr-F_DoRFKxLr7m_s8nSviPkXSfIr3RpjgaLB_qK6ZuereFc3BHwHrSMZpkwBqbMH0STJ6K41Qzdxmchz_72IzEY5Ki6mXw48iSpAfQ8H1TsLOy5We1Ehy6fhXZx4sckZDG77-RnaozzgMH5pdcydS8EYKqQFRK-i4B478vJMqSgoueTAQ18SF-QtHrtShyJOEpogUHBwLm-ZP3vszJ6c6WnbR_-BivAAXXPKbSM-gLqr4mnt-H3EdMVAuejl37kOfQycwGbntxtUIopM5Oy1yYSvqoGDUF2xI6-bIrO6rJ-0LAurrWuTIC3sAnAFehiLTpcXUIQxG-51xGoUaWScRUSVoq20vXdexhh6-l6KKPHuyLfV38jg8cDSlK_-cG_4_paNPCtTyxKB-dR2sJxYbWFVH0TQGNPCxkV7pcJg4r_HnMXZgIpAt2e1owf5PuHVjKCwgzjeELqaEglE-0dzaE5CcTAST-Y5Mh4nj0EbjhnSNsL4Mx5PYH4tclzNmjWm8yDqTGXMd6em4fPf1yCpmCktf3lMAbT3OvXjVOyEL1tG54wq24hA6bw_lFALO3NcR1fDCesO4E40eN4BRjGg_i-gOQH0nEKvs54O8J7enG69MuzRLZ0RM51XTvcpuFvzGJ21cIE6WjXxHTTBk8ImIzl9tOany%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669273584088529
Requested by: Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.150.39 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-150-39.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 249e4aeed9027cc779b55d69ce47e441cf99c74a400f24c4254635465e3d50a9

Request headers

Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: keep-alive
Content-Length: 26340
Content-Type: text/html; charset=utf-8
Date: Thu, 24 Nov 2022 07:06:21 GMT
Expires: -1
Pragma: no-cache
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.2
X-Powered-By: ASP.NET

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B1E7 1 KB
643 B 273ms
270ms Document
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 79198
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 23 Nov 2022 09:06:27 GMT
etag: 48472445140208031
expires: Thu, 24 Nov 2022 09:06:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DD7D 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c6bb6cc1f0ce9a795f6840daddbf44ca8d5cf670ba3784c441db6c522865f6e2

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6268 0
0 274ms
274ms Image
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221110&jk=3272243664975390&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame C8FF 36 KB
16 KB 271ms
271ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 20 Nov 2022 20:43:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 296594
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 20 Nov 2023 20:43:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame C3D4 29 KB
11 KB 270ms
270ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2oRYYnb2dF0b1cVJVDhbHBJHu2Qqmjmu3V-F7IIm4N2yfrD7EQQ5mqQPQQYVvNl0J2GcgTSWtkNp7FxbEBICM9X-gdg&cry=1&dbm_d=AKAmf-AKYqY6zBT826ZnBomS2nsXwH-NqzUnz-mjvngXvmT99yGEyeQENG5SbSrtgJpyGQ3Ws_S64awOkSHvdrEHjrl0AXs3j5Fek5tue6IhJVHTXaMCYyd4KeYiaBoRV7SAxRLKBfOI6DK2KDc3L8QH0INWIFhoXutj_ij0-Y96JmFOP_xrLZ_MKzpTT9t1Mq7tbmB1QafHPKQY1BulXdiRrHixTpkpmMFFIayXWIqCSwXtNnlZdBFjK39dLB64amB_NHtKqInqFw_uExC-m0hItAe5EtyMQvvWne1b_5COoM38md7O-loUpARMgC31Ap1c6S6TEr57ciRV8RPV5zz2RbrXCXUlmSWvZ7SEf5DAmjdiBOUOiTYazoRy4e5Tt6zkz8cd0kOXg4xXGvjpXfKYqtGAki5w3_Byk59CWDP82yFAxqZBt6ISaOgJSn8D8LV9Meh1zE7kqnpUyNzoRl8-AGRpBmSQATFOblsf82RFULYSndz13PMf-s6_5wN7XB064h87SiVlwaHdrriZuutv_SAv-vHf_ec1KC8aFI4UF5_wClGj-tA_pVzOf-FCoZrBd0xqnjs4lYcuuUPDNRQeNWC-nARrW5FQGYc3bYH_oBcwnaxEvzsgFpQ3Xb6ilasnyez5GJQlVjLwJ2mEjLHIJzx9HVP5TXFHZFrLBU9nZ0_7BkieCEjPod1DiD1asAl1poc05kiz9gD_4uikwlicYk0h9KS89rzxUGt7IJxOzjDsoPDdZ-p7jo47IqJC3xauDFjgcPQO2xOwVa3ytPQnKPGPUN5h1WtUAgALtE0dO8V8pFyGVp2O3dUJ1pWvjdb6T1XbYIhNxg_4ejGniOfNIi2Xb6BP9a3yEXinAxGSpORTMJiQ3K6d9pdkuScfBEi14dKW_BngwpNp2wXmK9Xdo3ylT4VdNLejQV7FvkDNM6KbcVl2IDm4HN18JvaO8cwothknQB5vHLwsWw_RB3pTPmtgQRegbZGDWYh3oa1FL4KdB6h8uRXTh2gkj7n9Ql5_ahWJdniRGzJ03nRHRevXGRHI_RV_OJNmkT4_QZqDQJ0b9UObkpjLaHHynDsxHVGvSg7nQtRHeg_OlmK9Wz7Kv471KR6mcvea3JQHJFjMMNR-9HWP2VqUUyF7_xMovJfw2xZYmaW47vuacAxqe26Q_KxnZOQCGnj5mXl9LM3pEzKg2sq80B6sV-5Q-wpidhM6EeQyjqBoxJvot0bDtfO9MTfuMrg_UYCuIxjeCsJQbaof2BPDZJug5vAjQVOvxo3_IXMYTBrSfxenEir5P2_Spor754fw2ROS0-WhHp7Zw6a0KQXU4H5gFww0C1GV8KgetcLQRbbknIHTDbLJ4k6-bajZaus85cXZs-yNG4W_B_YCmlhpKJp4fSIrwaLnS6iPbcUO-u2pvnGAjad3GvDQI0V3Oxk0LvVpIit9p8ayniAWBjnGtJ8XJi9Rak6JgJ8_RX9TXSdYQRgB5vFOLXUy2p0LCRjirP5uArtDNYl2Te2OxcJOjVETu9BcCy05Eah59A0IPIXVn4XSyFlY_lMso3CQt_V3TUwJjOyC6lhMg3DQw__fS3sSWcVMOZMVM3yXyQmxqYyvXrWynN3-dYE0TukYGFSQvHvzXy4GJKoRCQjmBhPsF2Iv6vhk6mSSO320IyvkrsZemmc06dcALydM9YcVCTC5olovpe7FHEpHIF1EtjfsWzSvTAFho0W7kuX_YbA-8PMawXnY3BhyXFgbxAzJSIa82zEr6agpT-GpKONl9oq-oIvwVKmEfXAudJ5AWm8jj-yW8v6ZRcPDUr2_QKsK7Skn3P6ghQCEhmQHUSuiBXXzFbwDzaVBxKecO46AbPmDxHd1Sx_SMwmvifEPfpyKE5lvDHMPzHOBs0m_fydJAfJ_DmwCtMRzC1kzJNd4oNYiBcJbZWMcisMFtO3K6xRUNiZyq25lML1jU-WVIqgqpPLb2RMye80Z_uROEODPKiHkH9uD5gC-yje1ZztniZ-RABP6vhgdq--bYZZG-gYyNEeX46ZFEAAlpYxcFMIYbyeJVWOiQ-8juJvXKnNGiccXlg3i-ltwTJiELLhf6Ls1o_1ELbcZymXB8fxG8-eu-s-_-fzXlk9EwRUxJ0BO5_FnPcQe-PgbfQtqorDbwia4ZXpZfGxut1NYB75HJ0IYPGFBqgSqnI8y5yVZXvRkQLT3JlEh5Ji8XCFfQk-4tfybOZ7MwFHlBfwvXR3LvZ2kQ9mgNgjhMO_LSbjrmfO6TTI3XXt_EgWqELWCB0jdZzFImzAhq_l30pr8_otMAMkkl7R3Q4GNO6w03KAo1WmbAwPtTYVqD96yzs5QOj2X7j9_aASxsLJKgN8DBRr7cIbCfjLyA5yaCI9BmM73tJi2L2mpIRDphYlU8fiSGdiD08f6Gzu3W511RpK6DwFnWzZ296BCVfhyCLp93yd5FPKvd61o_EijJnNfRQ6beHO-Kts6z5WrjbiV2usQpLPBvvOq0luSxPOoFRYpyzgZtvSF9LWOHFge8W--gl465jfeQjOQ16hgxBlhYkO8cwwHitNmy1Vx3xx3s33MXhwjvyOwSR5MRWY_RPQKiuiBxEVfRyV09rL_T7tzVFnliEq0UXyiZ1jmki1VZtsEyPYBHTifZjLyJRAX9f1aYPE0TB8qf9F0YCFVBDPY3s_IEKnUWlSU0kFsaTnHFnFVIfMxCqItZrG_swXEQkVM-jxg_nI-yPia4qBsz0tz007_pt7rSL9FlxkF3dbdkUxAdOphr7432J03vFK17ieA1ND7ORq-0LfoRjB0zMG2gbKjWyaDnkyGnUaMhHhuulPmSkdDq6ktL4tBTe3oQXXTg4jgJDLpgu194Y8TQCP4nfCCgM-WT2w1kfvcrW2Y5LIVh7hyYLrbz0kj25AqOGm9mFgRFI3Q0Qyj3ao1XONsDddtzHAiS8lEpK3ULwHhAQ-Xs18Dhn34qVPdbc24CrJzgSNP4W7Iwj5Ww3kVHjiYHwcJ4mnLvi8ENhahLcvYv71TwIQl7WqSbWvJE2DYy_13wpW0-To0Pf533i9cVMVs9bubmD_j7mKiNB4_YYAHlmqXPZKDRmkVzDqKsn30JdKxAfJBQvQbQN_AOap5ZeY57bvIM4gH0uyIjs_tiZa0ePMLMarzOEtj90tYY0uXOCIglsv_f7FspFeTGQi-Sy-dKnajYB404O3olrVjZbcVGTJfHQUVlQKmPtRWk5c7xGzuVKexhzFL5c5isl3WH6H9-CXAxyus6AIWeqNx96Fl6UvdzF8h2x9cYDdpQARbn0hPWmXSr8a9YGogXeUfyZMWDzBiL_KOSaJv0TYDKa11&cid=CAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 09:31:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77700
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Dec 2022 09:31:25 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame C3D4 8 KB
3 KB 285ms
285ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 00:04:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25289
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Dec 2022 00:04:56 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C3D4 0
0 855ms
293ms Fetch
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss8qXin3LyaoysXqLoJtq7ZPuxbjQ-T_Yel6of_A0JYfwjstxPXpsbIdS2vbAiy2BkaR721UjkX7yPx5QV9xK7W1xr1jnao6gLw-CbF3l2JHor7F5uChsJ22ruM0-MvDZnT6TBFofUHYacGqBqYqyuznz-shLl3ROkcAJWkGGQbC-JBXUytDW7Maqj97GTnT2-KRiyDr6zcxsSVxL_edetCcY6IgCTapsQ6l-kly8Js_nJpMJDSmvsXvXNxoUXY9LCuVGNNqQB3QJ4_8_aUdQDtivWXFuJM0DZhjvcwtZsdmWhTnmYtu6bwLhYSBdvbKKkO8_vTLUHfc2PgpS1olL2dPz8BkFJpG6OJx6P3sMCtX9ZynJa_Vu1E5vw-wNKLW4aXDHs7uJqeIbLP-XdX0Qpfjn5XfbPIp2oUPEQvwkUYqHq4cvbmlrJ8VQy9D9rZsewn0rvVeNXsJFVkA8QZihcUw9KjjO9rm8_PP5cNENY66YCULSDgwlKmhd5ItVm_GAIAukciycH0uRPZ-S-nLLbHv2YZ2Xn3MiXrm0n5tYaGf7teMaP8rG94ADeW8y_VmTbTwZURo1o7W9xN6nuRU2KB9xXx4a75P3kHZrBQiL-K1C8kzQeDpHlDtKJNxy9SCgC263hBEzVNLRmqw-yBMDpTlpgoBytHvPfTmp9RcMM7uf1QWU-IgyKoQdGo3dEpg-W5zP8zxykFUiqR9MpEt6az-yz2OxthrzUEQjujsDFo9AkrPofD1D0_MxKLn07V9UWjRZFhpOGYmBxP_YF2Un048fIIH16DEIUmgKJ8LTa2tZP2LfJPw4Xbyf1bI9YPKK3g8kjWj-Mu764wkMMDeroi-3n9bO0xc5cSQvldNnzZ1GEUCHVKhh84uy_dwi01u47oX0a8FWAcS7jFjNlnDJlYZa7Mgl_qGk-1NMDroA31YqppmwtvW74hoKX2xPzaAZCOgG6Y7By2czcLeIlhuEYwfq53OvHfk2yDjGmJBZTnvE6ZRSgi772aKWkSrQkJURj8U7YCc8MOJwXWm6aDQGOa7ik8k7-JY0y0cwtkiYcWowTGI76GIYHsvU_msA8hIvZGU5Ke1CO5bpIBfrVHbLgPf358UxYTf1YRRz2ue5AQiJA4ov5IlzP_h3XgM9PuhM9-wz_V5ZkWNDS_ZXNRJhPwQU3mFiiwMEONKZ4gzqBmxOQCONVXJLQH_td8KiK9BBnspACjkgTogyEomCKDhI4NdAT2pbs&sai=AMfl-YTcEb02DircBeOdy2q71rh8xTsdh02do4cKMlyS11LmD1l_iemh6IU8Jca2EfAmLGkbFJ-twTysNObOirl-ay70RPN2iZZyGsxpgU3TvAGDIY9iiRT4IPA4Dv4N4UNli0aiGfR3jqu4yR7fQhkd0Ql2jIQTMGrvKaBkawPGOEsgwTrzj9-yKiU27xRCbInxD1nGE0VHoOzg097ZNZUVcTZTnkfflILLYFgJ0C_UnY25tl4Me5V44__NQ6NrBFa4GDkBEOKXRWxfEg&sig=Cg0ArKJSzPRXqZlKTIZ8EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221110.27135&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 24 Nov 2022 07:06:26 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 24 Nov 2022 07:06:26 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C3D4 41 KB
15 KB 271ms
270ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 22:07:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 118718
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Nov 2023 22:07:48 GMT

GET
H2 200 8483959154689749763
s0.2mdn.net/simgad/ Frame C3D4 71 KB
71 KB 1237ms
679ms Image
image/jpeg 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/8483959154689749763

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

ab33c35828e33d51be9b74c7078f84e96ff150c798d5125c5e4d316e6a2f0c11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 00:52:35 GMT
x-content-type-options: nosniff
age: 22431
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72485
x-xss-protection: 0
last-modified: Tue, 15 Nov 2022 08:36:28 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 24 Nov 2023 00:52:35 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 5DBD 0
10 B 270ms
270ms Image
text/plain 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?PfKoCA
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:26 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B1E7
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEAkNFdbuc7yUJ5tkbi2V9B4&google_cver=1&google_push=ASkJ3FZ3p05uNvTpRuVTUbPyOa3t8ZMrEmFwxrURFmTvBfEfQho0lul...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=48a76414f9920c4&is_secure=true&networkId=14000&version=1&google_gid=CAESEAkNFdbuc7yUJ5tkbi2V9B4&google_cver=1&google_push=ASkJ3FZ3p05uN...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAALpApWfT1JuANnA1aHAAAAAAA&expiration=1669359987&google_cver=1&is_secure=true&google_gid=CAESEAkNFdbuc7yUJ5tkbi2V9...

170 B
188 B

279ms
278ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAALpApWfT1JuANnA1aHAAAAAAA&expiration=1669359987&google_cver=1&is_secure=true&google_gid=CAESEAkNFdbuc7yUJ5tkbi2V9B4&google_push=ASkJ3FZ3p05uNvTpRuVTUbPyOa3t8ZMrEmFwxrURFmTvBfEfQho0lulrh5TxKcRoB-RbFZ6to7feBlanm4XNbnrAtjQUh_J2bi2jdw4gDryNn-RXU54jPUtW9GtglCkdjI9x0sDkHTJB3O-75LAClfFj_n0

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAALpApWfT1JuANnA1aHAAAAAAA&expiration=1669359987&google_cver=1&is_secure=true&google_gid=CAESEAkNFdbuc7yUJ5tkbi2V9B4&google_push=ASkJ3FZ3p05uNvTpRuVTUbPyOa3t8ZMrEmFwxrURFmTvBfEfQho0lulrh5TxKcRoB-RbFZ6to7feBlanm4XNbnrAtjQUh_J2bi2jdw4gDryNn-RXU54jPUtW9GtglCkdjI9x0sDkHTJB3O-75LAClfFj_n0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B1E7
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEFAKeVLMP9xBFkwYZhIdElk&google_cver=1&google_push=ASkJ3FZCqfFY2nVd3yg_p7-68NUB6VpQhI4WTRqoBMGJVm12vY2JyhjQSiT-B0eGe3Q-zbQ0fr5knewJegaS9LUiiyqoiWpeiBVrg...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FZCqfFY2nVd3yg_p7-68NUB6VpQhI4WTRqoBMGJVm12vY2JyhjQSiT-B0eGe3Q-zbQ0fr5knewJegaS9LUiiyqoiWpeiBVrgCEjITPiEMFet9BbYfsmCbbH90nYSlDscm...

170 B
188 B

277ms
276ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FZCqfFY2nVd3yg_p7-68NUB6VpQhI4WTRqoBMGJVm12vY2JyhjQSiT-B0eGe3Q-zbQ0fr5knewJegaS9LUiiyqoiWpeiBVrgCEjITPiEMFet9BbYfsmCbbH90nYSlDscm_vQgDd9VolbEQSwLaPNDg&google_hm=TVRx8Fpkx74RyDTZUVzaXQ==

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:25 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FZCqfFY2nVd3yg_p7-68NUB6VpQhI4WTRqoBMGJVm12vY2JyhjQSiT-B0eGe3Q-zbQ0fr5knewJegaS9LUiiyqoiWpeiBVrgCEjITPiEMFet9BbYfsmCbbH90nYSlDscm_vQgDd9VolbEQSwLaPNDg&google_hm=TVRx8Fpkx74RyDTZUVzaXQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: c0tm6iea0n0u0quppgff2vmthuo4bblu

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B1E7
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKgwaxsXXZSWbyNUQMzH3-o&google_cver=1&google_push=ASkJ3FZCoFvL1mO7htl5UUVTid6IT_MB03X9l3GI5edmt_TxSbrL6ljzzKcGoCtyRCVRdZdyX8I...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFVUUUzWFotMVMtTEJVMQ==&google_push=ASkJ3FZCoFvL1mO7htl5UUVTid6IT_MB03X9l3GI5edmt_TxSbrL6ljzzKcGoCtyRCVRdZdyX8IXhmCfzXzSI-0smeJZeU2-2dj9K...

170 B
188 B

275ms
275ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFVUUUzWFotMVMtTEJVMQ==&google_push=ASkJ3FZCoFvL1mO7htl5UUVTid6IT_MB03X9l3GI5edmt_TxSbrL6ljzzKcGoCtyRCVRdZdyX8IXhmCfzXzSI-0smeJZeU2-2dj9KxdCLQOjEZX0DDEDfyezmSPGXMqYOSBOeZj_wS-T331lVJxd93Qd0xg

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFVUUUzWFotMVMtTEJVMQ==&google_push=ASkJ3FZCoFvL1mO7htl5UUVTid6IT_MB03X9l3GI5edmt_TxSbrL6ljzzKcGoCtyRCVRdZdyX8IXhmCfzXzSI-0smeJZeU2-2dj9KxdCLQOjEZX0DDEDfyezmSPGXMqYOSBOeZj_wS-T331lVJxd93Qd0xg
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: beb52df1a5a4b2f2cb3f37642c514298
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B1E7
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEE...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=ASkJ3FZ8XlW_dhBJfoEsFLCEc9y-v494NxLluUZtP441Oglt-Zq_Ja7FHH0_yh94VOgNT9oKcHmMfSNyVNpb0Yq6CcfNcsV4DQNdWFvGP44vaz2YBP0NDk3PWcmebOoYxih...
https://sync.targeting.unrulymedia.com/csync/RX-f256db65-b2d3-4798-ae52-901f8291d64a-004?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DASkJ3FZ8XlW_dhBJfoEsFLCEc...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ASkJ3FZ8XlW_dhBJfoEsFLCEc9y-v494NxLluUZtP441Oglt-Zq_Ja7FHH0_yh94VOgNT9oKcHmMfSNyVNpb0Yq6CcfNcsV4DQNdWFvGP44vaz2YBP0NDk3PWcmebOoYxihu_OTH...

170 B
188 B

275ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ASkJ3FZ8XlW_dhBJfoEsFLCEc9y-v494NxLluUZtP441Oglt-Zq_Ja7FHH0_yh94VOgNT9oKcHmMfSNyVNpb0Yq6CcfNcsV4DQNdWFvGP44vaz2YBP0NDk3PWcmebOoYxihu_OTH3t9z84UtiinxDGQElYk&google_hm=BPJW22Wy00eYrlKQH4KR1ko

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ASkJ3FZ8XlW_dhBJfoEsFLCEc9y-v494NxLluUZtP441Oglt-Zq_Ja7FHH0_yh94VOgNT9oKcHmMfSNyVNpb0Yq6CcfNcsV4DQNdWFvGP44vaz2YBP0NDk3PWcmebOoYxihu_OTH3t9z84UtiinxDGQElYk&google_hm=BPJW22Wy00eYrlKQH4KR1ko
date: Thu, 24 Nov 2022 07:06:28 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXf256db65b2d34798ae52901f8291d64a004
content-type: text/html

GET
H/1.1 200
OK ebda_cs
y.one.impact-ad.jp/ul_cb/ Frame B1E7 11 B
218 B 961ms
318ms Image
text/html 35.213.109.249
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://y.one.impact-ad.jp/ul_cb/ebda_cs?google_gid=CAESEPEY8P3FCL5jkvMsixVIJ_U&google_cver=1&google_push=ASkJ3FY2aLBv-LhIomHELtk1E207U4gK3xTNE3nhfiZx0JpFul_2fZ6PcCYyPMLdSqoH9MzPBEuZ8QzlnJ0bw0dVGF2ZrUTA9p7PCrmcGnkxKS_7TT5vndqMZaEX5dNMp56RJSWyYdRTa4LsNVT-DksL39Q
Requested by: Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.109.249 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 249.109.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 24 Nov 2022 07:06:26 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 11
Content-Type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B1E7
Redirect Chain

https://google.dap.fw-ad.jp/dsp/google/pixel?google_gid=CAESEKdHQrykOfV_kbyqVu1wr-Q&google_cver=1&google_push=ASkJ3FabmByCXBY-7Dp-VNPl68MRfVmkIEBQMNUl-HmrnEkOZ_FCYgbpgDKFEZyL5AkXH7Sk2AFmuVTBWZTvmYD...
https://cm.g.doubleclick.net/pixel?google_nid=docomo_ads_platform&google_push=ASkJ3FabmByCXBY-7Dp-VNPl68MRfVmkIEBQMNUl-HmrnEkOZ_FCYgbpgDKFEZyL5AkXH7Sk2AFmuVTBWZTvmYDWQfrfOINjfuQTiYDsGfdYYKiGiqHY9T-...

170 B
188 B

275ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=docomo_ads_platform&google_push=ASkJ3FabmByCXBY-7Dp-VNPl68MRfVmkIEBQMNUl-HmrnEkOZ_FCYgbpgDKFEZyL5AkXH7Sk2AFmuVTBWZTvmYDWQfrfOINjfuQTiYDsGfdYYKiGiqHY9T-wXWRszPUCszOfAxYDZHcLcg4l1ifLnKfphNuY&google_hm=YWRjOGE3Y2QtMjIxMy0zNDU4LWExZjctZWMwZGFkNTFmZDA4

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=docomo_ads_platform&google_push=ASkJ3FabmByCXBY-7Dp-VNPl68MRfVmkIEBQMNUl-HmrnEkOZ_FCYgbpgDKFEZyL5AkXH7Sk2AFmuVTBWZTvmYDWQfrfOINjfuQTiYDsGfdYYKiGiqHY9T-wXWRszPUCszOfAxYDZHcLcg4l1ifLnKfphNuY&google_hm=YWRjOGE3Y2QtMjIxMy0zNDU4LWExZjctZWMwZGFkNTFmZDA4
date: Thu, 24 Nov 2022 07:06:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-store
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B1E7
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEPv8YE9wmAyIcmOBg1OFlKs&google_cver=1&google_push=ASkJ3FYnjXb7fjSgcxY-GoSpSTq-dUPsfbIuFkz_NzW1Hw34Q0zqa0D6NAe6jSdg2HCrpB1iYR...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEPv8YE9wmAyIcmOBg1OFlKs&google_cver=1&google_push=ASkJ3FYnjXb7fjSgcxY-GoSpSTq-dUPsfbIuFkz_NzW1Hw34Q0zqa0D6NAe6jSdg2HCrpB1iYR...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1la3QxNVdsRTJ1R29QdTNiMTNHaGo5TjhsM0Z6MHQzNX5B&google_push=ASkJ3FYnjXb7fjSgcxY-GoSpSTq-dUPsfbIuFkz_NzW1Hw34Q0zqa0D6N...

170 B
188 B

278ms
275ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1la3QxNVdsRTJ1R29QdTNiMTNHaGo5TjhsM0Z6MHQzNX5B&google_push=ASkJ3FYnjXb7fjSgcxY-GoSpSTq-dUPsfbIuFkz_NzW1Hw34Q0zqa0D6NAe6jSdg2HCrpB1iYR1GMayB8ITYIt9no9a4DE3qpJ6TvjB5F9uOmF5ySnEZ9Aick6y4aEbu9S1rU_kNjtBYWKXk1oUvnSJ26P6r

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1la3QxNVdsRTJ1R29QdTNiMTNHaGo5TjhsM0Z6MHQzNX5B&google_push=ASkJ3FYnjXb7fjSgcxY-GoSpSTq-dUPsfbIuFkz_NzW1Hw34Q0zqa0D6NAe6jSdg2HCrpB1iYR1GMayB8ITYIt9no9a4DE3qpJ6TvjB5F9uOmF5ySnEZ9Aick6y4aEbu9S1rU_kNjtBYWKXk1oUvnSJ26P6r
date: Thu, 24 Nov 2022 07:06:26 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame B1E7 0
12 B 275ms
271ms Image
text/html 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K7Fab4ClOozC2iKnK1h-FwTP4eUvIcXONl20YOKTQ4DkzUpq-cFflVM0eHxrXgR0W-2oZwyNM

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:26 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E6E8 22 KB
8 KB 271ms
270ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 113179
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 23:40:07 GMT
expires: Wed, 22 Nov 2023 23:40:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame C8FF 0
10 B 270ms
270ms Image
text/plain 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?-SLTcw
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:26 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame 3EB8 29 KB
11 KB 270ms
270ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BK-FKRA8N3XLjLLUpkQztOGXwsal3h1EGLrSP8jHFVSlxEYFqzpZdnpPVBK6iAGeLWVHR_Yz6rnZdLvO2SKvXYlzWG7Q&cry=1&dbm_d=AKAmf-CLpzNGwCwTECEx9JoF6tr3IcltMzoLm9Q_82IsTBPq1Hc4Nr9eCZyoBhVEhLkkdxPNiSXHhXDOoTP_MXpJi2j7rQGzcMHrRpU4tGPIjs86cCrjL9zn7dFXQXvHdQQ3giKgbGzUeN48iSc2KOV7HOssYChD4ki5yo6Y_dJfZnTKdxNSteLQU5MAwcf_9jQzwtu4ZswScJRJ6sE_UqXEdm5194KN6b2ndjclCbMYWEqvKW8rKNQZ1xqwbqJQAW9pqZQDPmOPwrKti7bL4uQmQ3gtlahWMY6p5-f4QYQtgRplYXVbLGnPhSzFxHCF-8G8dXKrtIRc4xZcwUnJFZk7-D9C452ZMw9phdSbdFa_XevpRgxUC4ZwQkUrMEwT79xShGj9KVHli1HoEtZZzRGrr6xtlQJ6EjKxG_IwrvnY-Xg4kgxLfu9I34QMeUbDJWeY203iQqwJiCxdEPMujQDDCe8mYWejuruu6m-qR7-b4VZEqcDkxCe57aJtC0RXduhzz31DT20zQl8Ubm9I65jHJvWTy--KcxBn5X7EkjCOklybdI4EW0io95dosNJMJQ3MXK8watKFP5RJ7-LviApP0EIZii_8KNosXwP9TS9my1qwWcz6txMj7qtKN7RhBFGESdyE_YkUovVy0sWywHOVM6cvuG5x3XHgDbQQlOr7nE1r_FHq0FMjCoDiZuKosGb8VQQdzx7jxH_bzx21-GO0NVIPetM5LDKtpr3anhNiXYFSNW2n16b7QkaAh1Gn9CKZbDPHMjRcdNlH064yWImUOGLqk_qZE8ytbKKkWHGOvNW79tbqw3cuZ_v8_eww_-M6zmy_AXGefrscIIgbwxGSWz1x3t_glSEqVVZ1AwDqn_EvUVMzoxEdMKGDl2HH3Hj30yp0_lJmJVADKHZyBqeixl_e2FLFqRKgPCZWoUJOEwf7m3IRm3wAv2nX0_ZT3pE8fsUKMBWTtwsK-YoBM_DYbeA7Yo0eXrJKUe7YgNtYtNSkcgvc-0kVLrvY22U0JmA4orO-kWicq-43QzyPlkMj1U3YuSI36Ak1FlJ_q6_MoOXyTUDD8iP2gRej4mI2jiBf_jw9LDwraPRNBcY5sZbAwqZXxMYe4duHqOvIOCmjhD1u8BgeUTD5Fmb-aEeE39f1Ylo7a2m4cT2n-_5CVB7m2YEWcByW0wGjZL1pY55PEQDlS4jcfgsiWZNQijU5yAWCZxhblnMvaYNXSFieqTDwEgtUNgHHIvuTNAMFFlVvnEry9c0cJ-XEaMugAgV7ejSmXIBz5AHwLmw39Q-xQGAFDSh29exDUTAGpA0ED3_WzhSqktvpbTWQx5dJX7vCAp233_prjX_zZ0OanWXMhc2jN60RI9i199DHzoe5Z8ckt2hbW8ly2eOSaUrXGWLJQDwrBxTJwOKfCJVFETH7scYx_Y1wMGB0vA9ph2UelxuYxgatnlLajsNgNE-hmyrN9H-2XAhGYOCQ_Me5sScxkwwvEnV_uzbmuNBzYlzCpa1MQKQjxRxYT_TUDPiqd2t16cTiJwqGCz9vKDu11iugqqT0pOWToStNc8ayUGx_dbbgiHDKF2EkxpfsMhduW2KzeIs7__KeeOIoTa2CBXtsuiSKndNiqn4O0kDybuSDj07ckc0JHN6eTZatOtxdpo5b2Lx2HDGPZUa0_JN2lqTSrEXnZxEt5M5qg6YQM-OcSRNyewKGY-UxyCKW3hWlhcadqPr5Osod0PoyZ63nhX2IhrQAVjTj4eF40NvnsQLFv3l1N59cbNszMSLmFNq0fllSV9vHjfwNSVgK24i-S115Q8LaJJB9957eC-EinEUyiGRWg7ad5-7nYvfvoB7j7hk6U7U2YxfaYfp8uBVAUz2-A-d91n7Wrkqd8Hqbe2NOIl366WotCS6Fp4pGQdnlQA_5viTxWPOIyO1QZf0HU1o-AM78wmowMj7Taf6aCVxp6ses86_U3GmJLo99RCUC0h2p9eMM_Wckcuk8vg7dzIuKjoH7cO6nQpWOKhsX86p_fRcMW45ad9W2X6jZ8fHf7oGKwZg8UIQzd4LdnsZu8xjFOJdBQnv6etjVTEdQX8mwDsJp3GPypLVcvqU1RtMKcE9UJOnnnRf3f6_PLYQmiON-QinZuqQXl5LI8_75wEadTgEVUuoHumGQy9zmV7KnpeSPX-PDhcGjHJ6bCli1-eVyuVuVsj7o6uGkKGfxrG__b4kWF0nIKrt5_NwypWi9l9t3eNvy6kzbinrgs2b2gM8tnQdE3xRBd6qbVzmXPGjM7w50Ir_md3-B1FqkQCgZ5Rk2dLaJ-GUjHDChK-vtrYVYDa04aaMEO9Jk89rqQP3HVYRulAfenRERaBX6nQG2F91uNHGla__2ZJpXHGF0n0GazC4dcSSbo9-51UqOiRx08VjcgaBA7r9IB4k3B8pY2lSOvaBws5ekzqayO7ufx5hV0MPk4HhICFKmMk6vKO9ztBR7U_XVQ69qBMsIbVil1IYdZctipR8mkKkrcZhNREVrjLD6qpuneoC5Ur2sAczROjYKv_uJeLJfeiKVC17K023EvRZMz-3rsL_2M_gYf2EUwUNhRW6E7VJq494fokKLAOxRGo825Bg3U8Vnk8YDFWsBCCaEhV-oyRzA96B7_AEdV99LJofuVUVVes0S4jVe2YnghcktHCRecEfZjc_3g4WJlwUT1bTRNpj0LZmPWuLCf9H8Fb-PAGmJFMM8mQNcKlGl1DR8NfnPqOxmbYKjmoj5uKqUny20D6NllCF2kmn8ZvjKPMNRLErEPBzlhW2hvFRt2Or1tupP6NuC1fBGviNGqdfSsC-bwoAFBe16oqLbAotes4tKEPJexguMIYBq0eeMp3DQlMT5huf_hbkBmMNkvsS55gbq4WuTZN5fv5d_7M2eMpsm7XbU0MtOPRZNzaSu2BUAMS7tZaSsSlldusCT1L4wv2WwDmKBZ3O3ESjWRhlGWCl3oNJufyzOWGzzXq_sJHBgmWIFz3wHfPtK6x9c7P3UgfJo3yxsOoh0Yb6toP17oXwrqsqTow8UzLwYuuj9yUB9RJe3B6ibFYUwwkEolX5o5JT1ySLIcOrugd_eLDmiD5wfwOpiVyEDFn5ZUEyIsq1yWxbgZZSsf1XGA0miQ7-GdrkqDQK33c6iJgLeRyromrXPw_JTxEhEAN1Nt7tCq6SLXOj90QMom7gV4LSNIr8PJ9r7POZXMqVJ3P_7C2yRMlpOIvxncTPgRy74u92rZo47p5Mw4ZlrdsN6VsNc9LDqh4OEv_EEiPpdJSlGBUhCA704Ux5y-oZWURgoNt-cKlW1tPHShdYywjcyTsWB0IW9-V3_rdfn&cid=CAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM&dv3_ver=m202209210101&rfl=https%3A%2F%2Fwww.bg3.co%2F&ds=l&xdt=1&iif=1&cor=12381268080485554000&adk=2857193498&idt=329&cac=0&dtd=10

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 09:31:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77701
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Dec 2022 09:31:25 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame 3EB8 8 KB
3 KB 287ms
286ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 00:04:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25290
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Dec 2022 00:04:56 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3EB8 0
0 571ms
292ms Fetch
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssHVs2TL35OBL6QnEFtETNYB2MyEPw7eRld0TzjfTQJNPHG-DQeTHEKIokenuZpLePs4esAHjte4KaIp_3SeWf03DmPmpD-Y9P4rNGdEoMIB0bZZH-OgSU1bZFdjQoE9YY0l0VowrD9G-ovo-Cf7mNg0GzUryjyLQ52ifm6PHM2IlHAinU7fwKEASdjZbq8RxVP5PeZbM5XqqGobWCcLUwu285GhNS9aPrA5ewwhcJobUFz82zG7SXt6mXRuEHL87pzDeHPUZZ8qn30kV2RwZBhpA4nt3uYADILFOLzljWndg7pGkNXtkD2ECXr6RPv0IKAMLRNzZZ2wmgLpt314vnB_lXubApoYQJSLTdawQiJ_Jo0Z_edsxajKZkHQSztGXu5pMwDGAJGigxwdotgfZGfShiEvFixdEJojOW80f-GrArZtpJfXYe3InOBEGmyRx4MinM56_oSKRvhqQOoK44BtP6erqDb__FZi7J7JcNTXlLDujQRudc_NidWb_iXQi6JrcgtBhwvwjAC0Tv2fIClFHWpIXXM1eWEYD5uRvNMKrSqh5lOYZ1Q0SCzqcjNIOIUBWLF3cntSMMoEoDZsUfREYorYLSxfCBxvGSbq4Vdae34j1jnt-x58E4e_GvEcJgn9nXcEWuTnvCeAocRpmhlyvwYprJXm1rmwagX8KWO0grPLD_K5UIAoN7P82rlphHlqIk3XqpaSC8aV0_ShrWhrWwmmjKhxS742HxUg8ltG4PPONarg7cyEHxxLIVgU_au6P9JF9LOMvlEfnLiL7wzIWyfOzJZ7idgn9zOacUpLiSIpPCOqlEZ09dnGSKFzmhdb0DjzimRwvkWgOqJRHA7121QSgvPTCuC4BM_fz-fMdiYrE3aOjFLdXuFnChxIpkSztnKg_Xzm3sG0nSqa7rS6C5exFSwm8TVTNbiajNuVoWClse7rwuoY_wgBbh_60JtAGJfSiFQFWSxK_D-rKnTtfMFxKn5SvOT9UcisQQxFpkbAOX_NqNu3BnP1kcZmdHP0pJiz8qwx1OBHm8g0FuAx0oLK2pc4H8clQxoMA8TegGl18ahUE-8cHGB8Ak7H8RHCMdvfFi8_FO4LbVPGGpK2Va5ry3XIVbK0v_FrISsuz1S_9SfsNdl4zFdZB9Vk9QynR5LwELJySRNTnE2B7DvoO0g0s7z_NpgpvTGP4vzqQ0p3sraGKvKO0ukUzkVOxiKriBAMzxAn-87NCC1xHqFC9nlHWldkDYzSQ&sai=AMfl-YQqGxzAvu4f3cPXoV93UEbEQHUAqhuT8J0Atdf2YbiT-YeZ3zwm6jdLd2Qrx-8_3zvzCGhFBZyld6S-AeaCkfoEfzEB-9DmMU0AdxJQnjARSYnAYo5pb4W4sMDKDOWUgIz4T-v3GfoJNMOVWKbyVQIg_U4LYkWY6bFPhfcxrSJRciPpuFpv7BSjeaD8dJd8GRglkQcJSHOLLyq9_bzyjbLVC2p703vIaCCcC3wAcogFQ1mv73qVQczRmc4uq0NgR3bbUvJ-Q0lqcw&sig=Cg0ArKJSzBKpcbl9aecPEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=1&cisv=r20221110.41223&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 24 Nov 2022 07:06:26 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 24 Nov 2022 07:06:26 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3EB8 41 KB
15 KB 271ms
270ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 22:07:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 118718
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Nov 2023 22:07:48 GMT

GET
H2 200 8909551713456980515
s0.2mdn.net/simgad/ Frame 3EB8 75 KB
75 KB 1266ms
989ms Image
image/jpeg 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/8909551713456980515

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

1add881ba8cc7b1b203c72e606681d0b94266179b93df4e70b28504104fb4059

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 06:19:58 GMT
x-content-type-options: nosniff
age: 2788
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 76300
x-xss-protection: 0
last-modified: Tue, 15 Nov 2022 10:03:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 24 Nov 2023 06:19:58 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4489 1 KB
643 B 273ms
272ms Document
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 79199
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 23 Nov 2022 09:06:27 GMT
etag: 48472445140208031
expires: Thu, 24 Nov 2022 09:06:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C3D4 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1993a610d973bbc920f92bf9fc43077bca16030210e7030078ce0a6aeb10f4a8

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame E6E8 36 KB
16 KB 273ms
270ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 20 Nov 2022 20:43:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 296595
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 20 Nov 2023 20:43:11 GMT

GET
H2 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame 8148 136 KB
46 KB 293ms
276ms Script
text/javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCGkqp8Bd_Y9GzBfaT1AaQ756ID5jKk7Rtip7hvYYQzdXD_NAqEAEguoTAM2Cr7LGF4BigAeDUsp4oyAEJqQL7fHTV8wGlPqgDAaoE3gFP0Ba7shq4axU4xrgATM7MbtJJ0KfVUCEvdtmO7IkRwG9g1otlYiLpz9M25fXOGvdzWwo_ajtWSfRU4ayhoAH_vVSenAlkm93l_GwERHIho_9wl93wJjSOa3EFmWfPjVmmCZxM3tu6oL8pJOIX9zZeyTzpFSvGy7hEsZv9ac26F5ZSoLhLI5QfKHqTI2mkigNp9J02KcnNuqOZfLWYtK8NKTbipXtnj2J3tIhJ0XPg8iih3dU9uejA6XvZllVBT9HONkTEj2EGAUf3dCYqEkW-yl-QaKMcVsyP6ExU637ABJSMxeXmA-AEA5AGAaAGTYAH4IyD_gKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIBhEAEYHTICigI6AoBA8ggbYWR4LXN1YnN5bi01MjM5OTM4MjEzODcwMzgwgAoDmAsByAsBgAwBsBPVjZwRyBPD8OfeA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM%26sig%3DAOD64_3t_pHiCp2ke2t00mpSY-ONLUvwFA%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-BT-0ZhcVt_dmLUxC677Qbm2UOdd3aIT-5U7x2bZ2wJctFUOEL3EqnV7PjR3gggyxIHb9ThiCRg_eC_zhEKvLZSHQnVbZbjjrXSV0qgokimWYfXXY81ahoK6CQugx2Jwlwl_pfebvxkGzGR3wutoCRFsWKWDCRC4HRhEPdEHsPTxJOgLvk%26cry%3D1%26dbm_d%3DAKAmf-ANMVvCcIIAAQE-Ws1JrRn6Z2_JzTIXhAoywPEM3JSr-F_DoRFKxLr7m_s8nSviPkXSfIr3RpjgaLB_qK6ZuereFc3BHwHrSMZpkwBqbMH0STJ6K41Qzdxmchz_72IzEY5Ki6mXw48iSpAfQ8H1TsLOy5We1Ehy6fhXZx4sckZDG77-RnaozzgMH5pdcydS8EYKqQFRK-i4B478vJMqSgoueTAQ18SF-QtHrtShyJOEpogUHBwLm-ZP3vszJ6c6WnbR_-BivAAXXPKbSM-gLqr4mnt-H3EdMVAuejl37kOfQycwGbntxtUIopM5Oy1yYSvqoGDUF2xI6-bIrO6rJ-0LAurrWuTIC3sAnAFehiLTpcXUIQxG-51xGoUaWScRUSVoq20vXdexhh6-l6KKPHuyLfV38jg8cDSlK_-cG_4_paNPCtTyxKB-dR2sJxYbWFVH0TQGNPCxkV7pcJg4r_HnMXZgIpAt2e1owf5PuHVjKCwgzjeELqaEglE-0dzaE5CcTAST-Y5Mh4nj0EbjhnSNsL4Mx5PYH4tclzNmjWm8yDqTGXMd6em4fPf1yCpmCktf3lMAbT3OvXjVOyEL1tG54wq24hA6bw_lFALO3NcR1fDCesO4E40eN4BRjGg_i-gOQH0nEKvs54O8J7enG69MuzRLZ0RM51XTvcpuFvzGJ21cIE6WjXxHTTBk8ImIzl9tOany%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669273584088529

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

bf6ec42c97f86957a324a484a37dd528b568a9ff2570965be53e6ec4b0dfdae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:04:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46978
x-xss-protection: 0
last-modified: Mon, 06 Jun 2022 19:45:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Nov 2022 07:19:33 GMT

GET
H/1.1 200
OK dyn-hype-multiitem.js Show response
www.adtrek.co/Scripts/Inserts/ Frame 8148 11 KB
3 KB 144ms
143ms Script
application/javascript 3.104.150.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/Scripts/Inserts/dyn-hype-multiitem.js?v=1-4
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCGkqp8Bd_Y9GzBfaT1AaQ756ID5jKk7Rtip7hvYYQzdXD_NAqEAEguoTAM2Cr7LGF4BigAeDUsp4oyAEJqQL7fHTV8wGlPqgDAaoE3gFP0Ba7shq4axU4xrgATM7MbtJJ0KfVUCEvdtmO7IkRwG9g1otlYiLpz9M25fXOGvdzWwo_ajtWSfRU4ayhoAH_vVSenAlkm93l_GwERHIho_9wl93wJjSOa3EFmWfPjVmmCZxM3tu6oL8pJOIX9zZeyTzpFSvGy7hEsZv9ac26F5ZSoLhLI5QfKHqTI2mkigNp9J02KcnNuqOZfLWYtK8NKTbipXtnj2J3tIhJ0XPg8iih3dU9uejA6XvZllVBT9HONkTEj2EGAUf3dCYqEkW-yl-QaKMcVsyP6ExU637ABJSMxeXmA-AEA5AGAaAGTYAH4IyD_gKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIBhEAEYHTICigI6AoBA8ggbYWR4LXN1YnN5bi01MjM5OTM4MjEzODcwMzgwgAoDmAsByAsBgAwBsBPVjZwRyBPD8OfeA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM%26sig%3DAOD64_3t_pHiCp2ke2t00mpSY-ONLUvwFA%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-BT-0ZhcVt_dmLUxC677Qbm2UOdd3aIT-5U7x2bZ2wJctFUOEL3EqnV7PjR3gggyxIHb9ThiCRg_eC_zhEKvLZSHQnVbZbjjrXSV0qgokimWYfXXY81ahoK6CQugx2Jwlwl_pfebvxkGzGR3wutoCRFsWKWDCRC4HRhEPdEHsPTxJOgLvk%26cry%3D1%26dbm_d%3DAKAmf-ANMVvCcIIAAQE-Ws1JrRn6Z2_JzTIXhAoywPEM3JSr-F_DoRFKxLr7m_s8nSviPkXSfIr3RpjgaLB_qK6ZuereFc3BHwHrSMZpkwBqbMH0STJ6K41Qzdxmchz_72IzEY5Ki6mXw48iSpAfQ8H1TsLOy5We1Ehy6fhXZx4sckZDG77-RnaozzgMH5pdcydS8EYKqQFRK-i4B478vJMqSgoueTAQ18SF-QtHrtShyJOEpogUHBwLm-ZP3vszJ6c6WnbR_-BivAAXXPKbSM-gLqr4mnt-H3EdMVAuejl37kOfQycwGbntxtUIopM5Oy1yYSvqoGDUF2xI6-bIrO6rJ-0LAurrWuTIC3sAnAFehiLTpcXUIQxG-51xGoUaWScRUSVoq20vXdexhh6-l6KKPHuyLfV38jg8cDSlK_-cG_4_paNPCtTyxKB-dR2sJxYbWFVH0TQGNPCxkV7pcJg4r_HnMXZgIpAt2e1owf5PuHVjKCwgzjeELqaEglE-0dzaE5CcTAST-Y5Mh4nj0EbjhnSNsL4Mx5PYH4tclzNmjWm8yDqTGXMd6em4fPf1yCpmCktf3lMAbT3OvXjVOyEL1tG54wq24hA6bw_lFALO3NcR1fDCesO4E40eN4BRjGg_i-gOQH0nEKvs54O8J7enG69MuzRLZ0RM51XTvcpuFvzGJ21cIE6WjXxHTTBk8ImIzl9tOany%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669273584088529
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.150.39 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-150-39.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: f824af6240aaa57ba4104f1969365afa9b6904544545284db4a7469e6a94768a

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCGkqp8Bd_Y9GzBfaT1AaQ756ID5jKk7Rtip7hvYYQzdXD_NAqEAEguoTAM2Cr7LGF4BigAeDUsp4oyAEJqQL7fHTV8wGlPqgDAaoE3gFP0Ba7shq4axU4xrgATM7MbtJJ0KfVUCEvdtmO7IkRwG9g1otlYiLpz9M25fXOGvdzWwo_ajtWSfRU4ayhoAH_vVSenAlkm93l_GwERHIho_9wl93wJjSOa3EFmWfPjVmmCZxM3tu6oL8pJOIX9zZeyTzpFSvGy7hEsZv9ac26F5ZSoLhLI5QfKHqTI2mkigNp9J02KcnNuqOZfLWYtK8NKTbipXtnj2J3tIhJ0XPg8iih3dU9uejA6XvZllVBT9HONkTEj2EGAUf3dCYqEkW-yl-QaKMcVsyP6ExU637ABJSMxeXmA-AEA5AGAaAGTYAH4IyD_gKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIBhEAEYHTICigI6AoBA8ggbYWR4LXN1YnN5bi01MjM5OTM4MjEzODcwMzgwgAoDmAsByAsBgAwBsBPVjZwRyBPD8OfeA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM%26sig%3DAOD64_3t_pHiCp2ke2t00mpSY-ONLUvwFA%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-BT-0ZhcVt_dmLUxC677Qbm2UOdd3aIT-5U7x2bZ2wJctFUOEL3EqnV7PjR3gggyxIHb9ThiCRg_eC_zhEKvLZSHQnVbZbjjrXSV0qgokimWYfXXY81ahoK6CQugx2Jwlwl_pfebvxkGzGR3wutoCRFsWKWDCRC4HRhEPdEHsPTxJOgLvk%26cry%3D1%26dbm_d%3DAKAmf-ANMVvCcIIAAQE-Ws1JrRn6Z2_JzTIXhAoywPEM3JSr-F_DoRFKxLr7m_s8nSviPkXSfIr3RpjgaLB_qK6ZuereFc3BHwHrSMZpkwBqbMH0STJ6K41Qzdxmchz_72IzEY5Ki6mXw48iSpAfQ8H1TsLOy5We1Ehy6fhXZx4sckZDG77-RnaozzgMH5pdcydS8EYKqQFRK-i4B478vJMqSgoueTAQ18SF-QtHrtShyJOEpogUHBwLm-ZP3vszJ6c6WnbR_-BivAAXXPKbSM-gLqr4mnt-H3EdMVAuejl37kOfQycwGbntxtUIopM5Oy1yYSvqoGDUF2xI6-bIrO6rJ-0LAurrWuTIC3sAnAFehiLTpcXUIQxG-51xGoUaWScRUSVoq20vXdexhh6-l6KKPHuyLfV38jg8cDSlK_-cG_4_paNPCtTyxKB-dR2sJxYbWFVH0TQGNPCxkV7pcJg4r_HnMXZgIpAt2e1owf5PuHVjKCwgzjeELqaEglE-0dzaE5CcTAST-Y5Mh4nj0EbjhnSNsL4Mx5PYH4tclzNmjWm8yDqTGXMd6em4fPf1yCpmCktf3lMAbT3OvXjVOyEL1tG54wq24hA6bw_lFALO3NcR1fDCesO4E40eN4BRjGg_i-gOQH0nEKvs54O8J7enG69MuzRLZ0RM51XTvcpuFvzGJ21cIE6WjXxHTTBk8ImIzl9tOany%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669273584088529
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 24 Nov 2022 07:06:23 GMT
Content-Encoding: gzip
Last-Modified: Wed, 27 Apr 2022 14:29:24 GMT
Server: Microsoft-IIS/8.5
ETag: "0fa1131435ad81:0"
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2968

GET
H/1.1 200
OK pol.jpg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame 8148 13 KB
10 KB 446ms
154ms Image
image/jpeg 52.95.130.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/pol.jpg
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCGkqp8Bd_Y9GzBfaT1AaQ756ID5jKk7Rtip7hvYYQzdXD_NAqEAEguoTAM2Cr7LGF4BigAeDUsp4oyAEJqQL7fHTV8wGlPqgDAaoE3gFP0Ba7shq4axU4xrgATM7MbtJJ0KfVUCEvdtmO7IkRwG9g1otlYiLpz9M25fXOGvdzWwo_ajtWSfRU4ayhoAH_vVSenAlkm93l_GwERHIho_9wl93wJjSOa3EFmWfPjVmmCZxM3tu6oL8pJOIX9zZeyTzpFSvGy7hEsZv9ac26F5ZSoLhLI5QfKHqTI2mkigNp9J02KcnNuqOZfLWYtK8NKTbipXtnj2J3tIhJ0XPg8iih3dU9uejA6XvZllVBT9HONkTEj2EGAUf3dCYqEkW-yl-QaKMcVsyP6ExU637ABJSMxeXmA-AEA5AGAaAGTYAH4IyD_gKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIBhEAEYHTICigI6AoBA8ggbYWR4LXN1YnN5bi01MjM5OTM4MjEzODcwMzgwgAoDmAsByAsBgAwBsBPVjZwRyBPD8OfeA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM%26sig%3DAOD64_3t_pHiCp2ke2t00mpSY-ONLUvwFA%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-BT-0ZhcVt_dmLUxC677Qbm2UOdd3aIT-5U7x2bZ2wJctFUOEL3EqnV7PjR3gggyxIHb9ThiCRg_eC_zhEKvLZSHQnVbZbjjrXSV0qgokimWYfXXY81ahoK6CQugx2Jwlwl_pfebvxkGzGR3wutoCRFsWKWDCRC4HRhEPdEHsPTxJOgLvk%26cry%3D1%26dbm_d%3DAKAmf-ANMVvCcIIAAQE-Ws1JrRn6Z2_JzTIXhAoywPEM3JSr-F_DoRFKxLr7m_s8nSviPkXSfIr3RpjgaLB_qK6ZuereFc3BHwHrSMZpkwBqbMH0STJ6K41Qzdxmchz_72IzEY5Ki6mXw48iSpAfQ8H1TsLOy5We1Ehy6fhXZx4sckZDG77-RnaozzgMH5pdcydS8EYKqQFRK-i4B478vJMqSgoueTAQ18SF-QtHrtShyJOEpogUHBwLm-ZP3vszJ6c6WnbR_-BivAAXXPKbSM-gLqr4mnt-H3EdMVAuejl37kOfQycwGbntxtUIopM5Oy1yYSvqoGDUF2xI6-bIrO6rJ-0LAurrWuTIC3sAnAFehiLTpcXUIQxG-51xGoUaWScRUSVoq20vXdexhh6-l6KKPHuyLfV38jg8cDSlK_-cG_4_paNPCtTyxKB-dR2sJxYbWFVH0TQGNPCxkV7pcJg4r_HnMXZgIpAt2e1owf5PuHVjKCwgzjeELqaEglE-0dzaE5CcTAST-Y5Mh4nj0EbjhnSNsL4Mx5PYH4tclzNmjWm8yDqTGXMd6em4fPf1yCpmCktf3lMAbT3OvXjVOyEL1tG54wq24hA6bw_lFALO3NcR1fDCesO4E40eN4BRjGg_i-gOQH0nEKvs54O8J7enG69MuzRLZ0RM51XTvcpuFvzGJ21cIE6WjXxHTTBk8ImIzl9tOany%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669273584088529
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.130.40 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: c6404a6445360d772e0e5b5f502a4b6f07dbee331c5132d95affd837d3b832ba

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 24 Nov 2022 07:06:27 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: D0BX64HEYFF7KMPC
ETag: "a9fd50a836ea2cd2d6c0d6bce07d76b2"
x-amz-meta-info: polite loading image
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 10157
x-amz-id-2: Tz4Mm6webDvHX/n1Vzr53/yB+CozVcI3awHtHbRIw7H7z097GVVKZAHskysm3ORjSAtzbG7SiTg=

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 18A1 1 KB
643 B 271ms
271ms Document
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 79199
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 23 Nov 2022 09:06:27 GMT
etag: 48472445140208031
expires: Thu, 24 Nov 2022 09:06:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 3EB8 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aa0b6c79a4d266bba7f5ff3349b2d4fddeed852df65e1d7bfddee0ee0b8fb7fa

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 4489
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEEttr74v247E0A_Ne_d2u5g&google_cver=1&google_push=ASkJ3FZ6vI8Si_qkEHLsoQeFiq1mttTyH87E1vZPMw9CFzV_562BWqSCSg5sxoXYevyVu_Ypw2SkpXvbw6-P90TJ869fbLspy72LZ...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzUyNTI3NDUwMTE3MzA2MjI0MA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEEttr74v247E0A_Ne_d2u5g&google_cver=1

43 B
398 B

506ms
262ms

Image
image/gif

50.116.239.135
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEEttr74v247E0A_Ne_d2u5g&google_cver=1
Requested by: Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 50.116.239.135 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEEttr74v247E0A_Ne_d2u5g&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4489
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESECnU43SYfqw0P9N-wh0BoDQ&google_cver=1&google_push=ASkJ3FZA6rIOQZ5JZMQtjVQjOpEKKpKsh3hPXcRNAEWJKJj1tA3hzRvhRF-r_kd9_tWvrpCJenUxjfSUyKtrIf8R6ubARba56PUHeU3t...
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=QjUwRDdBMDRENTM4MDdBMA==

170 B
188 B

274ms
273ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=QjUwRDdBMDRENTM4MDdBMA==

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=QjUwRDdBMDRENTM4MDdBMA==
date: Thu, 24 Nov 2022 07:06:27 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4489
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEP2LVR2FHxwT60HPtO8JFLk&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=M2Y1YzA1MWYtN2ExNi00MGNiLWE3NjgtNmFhNTQ4YjZlY2Y5&google_gid=CAESEP2LVR2FHxwT60HPtO8JFLk&google_cver=1&google_push=ASkJ3FbT...

170 B
188 B

276ms
275ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=M2Y1YzA1MWYtN2ExNi00MGNiLWE3NjgtNmFhNTQ4YjZlY2Y5&google_gid=CAESEP2LVR2FHxwT60HPtO8JFLk&google_cver=1&google_push=ASkJ3FbTPmlYigRAnMHTSMK-dKNjugrSlCVsu9xyXs1lIb6Wx-rCme_Pe4T76pF6354-f9QkYb15-ltowIkajnOo6Q8NowCqgFNAT3Iblc5dL0oOdIGrMUvF6E5V1lvrcrbtddmoeRFeIOLx

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=M2Y1YzA1MWYtN2ExNi00MGNiLWE3NjgtNmFhNTQ4YjZlY2Y5&google_gid=CAESEP2LVR2FHxwT60HPtO8JFLk&google_cver=1&google_push=ASkJ3FbTPmlYigRAnMHTSMK-dKNjugrSlCVsu9xyXs1lIb6Wx-rCme_Pe4T76pF6354-f9QkYb15-ltowIkajnOo6Q8NowCqgFNAT3Iblc5dL0oOdIGrMUvF6E5V1lvrcrbtddmoeRFeIOLx
date: Thu, 24 Nov 2022 07:06:28 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4489
Redirect Chain

https://dynalyst-sync.adtdp.com/pixel?pid=10&google_gid=CAESEEI4Pv0Yk5sblrs_YFAOwdI&google_cver=1&google_push=ASkJ3FY3_lHmM6hr0MWmIJ4G5yDZoRaQna1UvIq8Bw7sBqB4fKDVZ-s6WZVRrTskcwTsHoM5EKHgISMzasu3FVv...
https://cm.g.doubleclick.net/pixel?google_nid=cyberagent_dynalyst&google_push=ASkJ3FY3_lHmM6hr0MWmIJ4G5yDZoRaQna1UvIq8Bw7sBqB4fKDVZ-s6WZVRrTskcwTsHoM5EKHgISMzasu3FVv5IkiZ9Vh3QmyjQ1pujMjeEpZEvO3mlmP...

170 B
188 B

274ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cyberagent_dynalyst&google_push=ASkJ3FY3_lHmM6hr0MWmIJ4G5yDZoRaQna1UvIq8Bw7sBqB4fKDVZ-s6WZVRrTskcwTsHoM5EKHgISMzasu3FVv5IkiZ9Vh3QmyjQ1pujMjeEpZEvO3mlmPJg1zDcjZtE0yUDb8dqf5C0RGl

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=cyberagent_dynalyst&google_push=ASkJ3FY3_lHmM6hr0MWmIJ4G5yDZoRaQna1UvIq8Bw7sBqB4fKDVZ-s6WZVRrTskcwTsHoM5EKHgISMzasu3FVv5IkiZ9Vh3QmyjQ1pujMjeEpZEvO3mlmPJg1zDcjZtE0yUDb8dqf5C0RGl
Date: Thu, 24 Nov 2022 07:06:27 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4489
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEFAKeVLMP9xBFkwYZhIdElk&google_cver=1&google_push=ASkJ3FZr1fGciTp7PEBPlpB4pvhBBnYIQAMOlAhft_645Lp5c5qeHHLcKX61ATMIJ0eUXfOxnim_vKqpQNSXu9LtWcyBzjC6NGkuG...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FZr1fGciTp7PEBPlpB4pvhBBnYIQAMOlAhft_645Lp5c5qeHHLcKX61ATMIJ0eUXfOxnim_vKqpQNSXu9LtWcyBzjC6NGkuGhWIVc6mSsKqsuS1ddi2FcNfG51yQ7DX5E...

170 B
188 B

284ms
276ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FZr1fGciTp7PEBPlpB4pvhBBnYIQAMOlAhft_645Lp5c5qeHHLcKX61ATMIJ0eUXfOxnim_vKqpQNSXu9LtWcyBzjC6NGkuGhWIVc6mSsKqsuS1ddi2FcNfG51yQ7DX5EMglK0lldNA&google_hm=TVRx8Fpkx74RyDTZUVzaXQ==

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:26 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FZr1fGciTp7PEBPlpB4pvhBBnYIQAMOlAhft_645Lp5c5qeHHLcKX61ATMIJ0eUXfOxnim_vKqpQNSXu9LtWcyBzjC6NGkuGhWIVc6mSsKqsuS1ddi2FcNfG51yQ7DX5EMglK0lldNA&google_hm=TVRx8Fpkx74RyDTZUVzaXQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: 6ei8iceko4dp5qv77qkulmnnhuok01ra

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4489
Redirect Chain

https://cc.adingo.jp/adx/push/?google_gid=CAESEGe0UVzZ00IhrrzFDOLclMM&google_cver=1&google_push=ASkJ3FZCCPTyXaoWQSCfbjfUVRtn2pD_3A9HNBa7q8pFehMBNpH7rSzsFC6DI7P4D4a_f0J74_GvN1bMM89NaPCcXW9zcqF6PqsNe...
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ASkJ3FZCCPTyXaoWQSCfbjfUVRtn2pD_3A9HNBa7q8pFehMBNpH7rSzsFC6DI7P4D4a_f0J74_GvN1bMM89NaPCcXW9zcqF6PqsNeJEKOBibI3r4wx2g2mz7x9lL4ezc2U...

170 B
188 B

276ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ASkJ3FZCCPTyXaoWQSCfbjfUVRtn2pD_3A9HNBa7q8pFehMBNpH7rSzsFC6DI7P4D4a_f0J74_GvN1bMM89NaPCcXW9zcqF6PqsNeJEKOBibI3r4wx2g2mz7x9lL4ezc2UhtmgU7Vw91Ez4A&google_hm=fe5e0dbfa7c346d7069c6d9fdbde5fd9

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ASkJ3FZCCPTyXaoWQSCfbjfUVRtn2pD_3A9HNBa7q8pFehMBNpH7rSzsFC6DI7P4D4a_f0J74_GvN1bMM89NaPCcXW9zcqF6PqsNeJEKOBibI3r4wx2g2mz7x9lL4ezc2UhtmgU7Vw91Ez4A&google_hm=fe5e0dbfa7c346d7069c6d9fdbde5fd9
date: Thu, 24 Nov 2022 07:06:27 GMT
content-type: text/html; charset=UTF-8
server: nginx
p3p: CP=NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa HISa OUR SAMa OTRa STP UNI STA

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4489
Redirect Chain

https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEHeqL_I7r8_-ulBVtMZpbxY&google_cver=1&google_push=ASkJ3Fb6p7bAdK7EZ3-zUUnPcIdFz7H9AQylAT5bpu-yJXXrdbPyBpTGXyvsBdmBhIR37yIRbxp4ssrb...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.e-volution.ai%2Fsync%3Fexchange%3D193%26google_gid%3DCAESEHeqL_I7r8_-ulBVtMZpbxY%26google_cver%3D1%26google_push%3DASkJ3Fb6p7bAdK7EZ3-zUU...
https://rtb2-useast.e-volution.ai/sync?adkuid=A8862046235356698828&exchange=193&google_gid=CAESEHeqL_I7r8_-ulBVtMZpbxY&google_cver=1&google_push=ASkJ3Fb6p7bAdK7EZ3-zUUnPcIdFz7H9AQylAT5bpu-yJXXrdbPy...
https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTg4NjIwNDYyMzUzNTY2OTg4Mjg&google_push=ASkJ3Fb6p7bAdK7EZ3-zUUnPcIdFz7H9AQylAT5bpu-yJXXrdbPyBpTGXyvsBdmBhIR37yIRbxp4ssr...

170 B
188 B

275ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTg4NjIwNDYyMzUzNTY2OTg4Mjg&google_push=ASkJ3Fb6p7bAdK7EZ3-zUUnPcIdFz7H9AQylAT5bpu-yJXXrdbPyBpTGXyvsBdmBhIR37yIRbxp4ssrbm3bRnJcnP-Q_Vu9Xrmg2b3jk7r6TpoNFIbGnQjs4wO0OxHI9Yyfn17x8ixkL5d82IQ

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTg4NjIwNDYyMzUzNTY2OTg4Mjg&google_push=ASkJ3Fb6p7bAdK7EZ3-zUUnPcIdFz7H9AQylAT5bpu-yJXXrdbPyBpTGXyvsBdmBhIR37yIRbxp4ssrbm3bRnJcnP-Q_Vu9Xrmg2b3jk7r6TpoNFIbGnQjs4wO0OxHI9Yyfn17x8ixkL5d82IQ
Date: Thu, 24 Nov 2022 07:06:28 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4489 0
12 B 274ms
271ms Image
text/html 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KFO7d8iEEylhsxJ4XlOAcc14c0gPwhafU7w_PW4x4pb2mplFvQr1VF9MxYz5UDrU2FJbxtFA

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:26 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A5AE 22 KB
8 KB 276ms
274ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 113179
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 23:40:07 GMT
expires: Wed, 22 Nov 2023 23:40:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D2A4 0
0 278ms
277ms Image
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022111501&jk=212154892497660&bg=!oqGloeXNAAbvMpMzzzI7ACkAdvg8WgZSAAQdyY6idI9OU3j2kmqZueLi8-32B-_22O5S5iwZR9ocVwIAAAC5UgAAAAJoAQcKAGTlDE3o9-jdUXqOoL61YgUrw8lS_ggsCo-H8_xubyuTO5yq7eoMW4ab-yaZeu5iBqMPOwwWQujEq0lo0k-BpD4GAh8rUDVRvlwLQAErISnv9XctijcQPVXVkTgDZTW6mt-S9oF2mQLIFTfqegantqw0yAhxMvS2CmuAe3gNz-NvQ5CGWYATzBzyCwaauM1MJ-T8OpjgyXMP9YuOIQrFwFlAkiR2yOnCCJoUAcvoEOd1oth77DfU5tZnqsMgMpVstzjLzfQsrvr-J8oBlPVWz21OLexHS2pIvHYHGj52ychQ_PP9x5SXsNJcNVmjuHlx3hGW9Gn8u8tvrPkJqx9bpdmmQ-B6eLYvIvpVBNaQMxaMlCgO-GD1xEBJqw0wgBy2R4FPZCgOB-WHuzu1BhYOYBXGfWWsCyMPHH-eTPyxWPzmQJCau3LfhGAMY1T2YkUBcjqoz6h3GBcUFzAx2ck8UHbltqQMf0bRfFZExcgByyoxfxmD3l3eAC_26LxG5qPfOv9ngFOdxe1CehuI1z-am1APKBsjeBvdlx-QIYyoZLQvLCMS6Rk4Y2ZEi7Ls3r2N8V8SgFvAllvnm614O0ytQ2b4ro_rMsUHlANDB2mnkmz58NNcIO-4EGLcklQVClnCltpLVWnMmxhaNniLox70fBcT-uq-9nlKSwYBfRKEiZH7uR0P5VOuZenhCiQRe3i8ojEt9sgiPgx7GSmHFhhv6-WGYoSkczPlYdUY5MMe-IVjGq77rli4r6j00Xjrjhb8-8A7ItEcix0SC0jaQlKaLjK0jBPDv_i-8QyaVlIphcFKqhbD91FzgZ6KRQop-YcuvPpx_nNftyXBUmnLtXQn9mjMbMQ_Pb6qiDrr7T0TJ_abq7o6T5j8o7D-ccVSC2CusJlRpOE5xt8nawr_MJN_kVTV_joIQ6Qk1Mc-n3MLp7f3O3_RXvbeh584gw3cYfMVWAWLLm2BRzO_t4iafUjz-OHItn9P26ljeQH9ts7tgR6CHFknWIvbg5nzcXO9Tvjj-XFSGhP_KpaLikVdsuHFTa5MYilmvh1achy97MpZezQ3GRaA3NKwFj_Dl3445zAZrQ
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E6E8 0
20 B 275ms
274ms Image
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BbF838Rd_Y_vyFprivwS7gYq4CgAAAAA4AeAEAg&bg=!wMOlw4fNAAbvMpMzzzI7ACkAdvg8WvTCBWYDy1B2BHfApbKPbP3nIqLoWdNJRe-wEoBRkGZQG2X7cgIAAABaUgAAAAJoAQeZAvEI1NMiF2YNq0xrzNLchRaXD7Cq09JsCACADRVrV8hdnP00zUxbba6sEHaOmPMVYHkK8_rCdqm0dPd0yJTGYytBjoYvvoW6frlm3NurMNVn-hcwvtu2FY0ssVQlz8Wahng4fjt6sXdShkaOnSsl-wLFbQGaKn38IlGegzKVOZIz2Zmwf5R2wQ8XyEZ6_ESLPXIZPP53Jd0zqBGST9HJAUbS2nq4Jt2-wxPiedskVwiEkS9oCNnpV48qor1P1TtepJBMlUnTctvVebD9QylYxd54IyepiNAeQeGM02g1jeKU6G6eNnGts0mBRuxYJyhBmTv0GIHxptuEWnlf30LnIBzaGvGmf5kzXR14wtL2kQQRDeqYI245KQIyxI9IJD283O2mb83r0FxqWRscVsBwuHHGiJqtHu149G0hZlkC7X_dhgMUu9ax73yyosJ3hgA-MoFQ0nfmtlkp6p2B-A6WhkPF6GZKk7x0cp8vs4YDnquxrnbyCUSj8iueRmjLd21d9cy2DvfMPMCzs5LkkjfRuYdt4UamQBgYnTXzbBcQ1XDRERB46-I-el93tebYlbT05QHIgzEG4G01J9Fv-r-P57rnBS8-j3OKY0NNESeGtTTgBJDKIdX-xYsorS-C8hdh97ydhiRkHxPTvV6EmJRLpYL4mYVNsyt3amdwMOcuWnRu_-Nmk3y-zH3x6YhLuOS8RoTS8bKWlLdzUHjlC9FLecLfD3RWEgfOfGxUVkMD18jmKIYgZsjgvo54hjFg_ZIf6uqHqEkI92j2uLK6jxqq6bWqGV_CcprADMqp6_-24wPRbhrErlpgF0UMWOlR3UZQgO9X5u88t25ZTlGq1Pd8JHkl9EYiGlwaXtWfXbiqiiZKfpA7lx2ZkJ3UtRHLAOB3CPP1OCa0io5uF8f4hVUqXlgtEq7CnyouebLdNX1b7zJ2s8AeLriHGt2dGkohKh8QAPs7HaoYOsd2KfiXETvpMO496aS79Px_F5yyuEJHM4w68d4

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 18A1 0
173 B 529ms
236ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESED9FOnfMcw3nz475T8YsItA&google_cver=1&google_push=ASkJ3FbDGVR1Kb4-R8UCl5lVO1ULN_E4_JQQpOjuvR9dBVy8IA3aAfrrUZ0FE3li0ynQkXN8OA4y0TdQRU-4ymKivRyAdCahf2-pBHqmBM15hA6ziXJz66hmlEj-YCTDuiuY2PTjecF4c4Xho9NB9FD6KtA
Requested by: Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:27 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 18A1
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEP2LVR2FHxwT60HPtO8JFLk&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MTE5NGUzNjQtZTc2Ni00ZDUwLTk5OTgtYzRjYjdkYmNjZjA0&google_gid=CAESEP2LVR2FHxwT60HPtO8JFLk&google_cver=1&google_push=ASkJ3FYv...

170 B
188 B

274ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MTE5NGUzNjQtZTc2Ni00ZDUwLTk5OTgtYzRjYjdkYmNjZjA0&google_gid=CAESEP2LVR2FHxwT60HPtO8JFLk&google_cver=1&google_push=ASkJ3FYvlbH_WGB0Dh2aBLz5Ru5kVUQ82QJ4caYHAuqD4eQUjAiWM8WV6i0WUZzwRzKsVLku21rZmtXxLVoivRDTX5XU5xvK9HerX2Je1nJYx622tw13fKgT046Cxmh3o4J52zws3ZN-zxLYmOcDUCsPl-A

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MTE5NGUzNjQtZTc2Ni00ZDUwLTk5OTgtYzRjYjdkYmNjZjA0&google_gid=CAESEP2LVR2FHxwT60HPtO8JFLk&google_cver=1&google_push=ASkJ3FYvlbH_WGB0Dh2aBLz5Ru5kVUQ82QJ4caYHAuqD4eQUjAiWM8WV6i0WUZzwRzKsVLku21rZmtXxLVoivRDTX5XU5xvK9HerX2Je1nJYx622tw13fKgT046Cxmh3o4J52zws3ZN-zxLYmOcDUCsPl-A
date: Thu, 24 Nov 2022 07:06:28 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 18A1
Redirect Chain

https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEIs4nlgt7rt8s83ua1VqYb0&google_cver=1&google_push=ASkJ3FaECJCvITtPNR0142yHEzb9v7LoumfHk2eh4oQOYWQUOVX-wYWRq1-zOPGY1XlrhZGp4-Vs5VsyEp...
https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEIs4nlgt7rt8s83ua1VqYb0&google_cver=1&google_push=ASkJ3FaECJCvITtPNR0142yHEzb9v7LoumfHk2eh4oQOYWQUOVX-wYWRq1-zOPGY1XlrhZGp4-Vs5VsyEp...
https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=ASkJ3FaECJCvITtPNR0142yHEzb9v7LoumfHk2eh4oQOYWQUOVX-wYWRq1-zOPGY1XlrhZGp4-Vs5VsyEpOsGYcnAMirkaKtEg_K0hLi8auhfLpfWjvlCIRRWke-Dj1WoG...

170 B
188 B

274ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=ASkJ3FaECJCvITtPNR0142yHEzb9v7LoumfHk2eh4oQOYWQUOVX-wYWRq1-zOPGY1XlrhZGp4-Vs5VsyEpOsGYcnAMirkaKtEg_K0hLi8auhfLpfWjvlCIRRWke-Dj1WoGljOE73skoK3Ux4_1eE09CZzAc&google_hm=MDMwMzAwMDFfNjM3ZjE3ZWY1OGIxNA%3D%3D

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 24 Nov 2022 07:06:27 GMT
server: nginx
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=ASkJ3FaECJCvITtPNR0142yHEzb9v7LoumfHk2eh4oQOYWQUOVX-wYWRq1-zOPGY1XlrhZGp4-Vs5VsyEpOsGYcnAMirkaKtEg_K0hLi8auhfLpfWjvlCIRRWke-Dj1WoGljOE73skoK3Ux4_1eE09CZzAc&google_hm=MDMwMzAwMDFfNjM3ZjE3ZWY1OGIxNA%3D%3D
content-type: text/html; charset=UTF-8
cache-control: no-cache
keep-alive: timeout=10
access-control-allow-headers: Origin

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 18A1
Redirect Chain

https://dynalyst-sync.adtdp.com/pixel?pid=10&google_gid=CAESEEI4Pv0Yk5sblrs_YFAOwdI&google_cver=1&google_push=ASkJ3FbMWtV7IM2lcok9WIK4kK76TC2gK02vniVIfjhVOZQAY2kBGOK31xzPzXQzRozLMl7oGUahOZReB6IZGlu...
https://cm.g.doubleclick.net/pixel?google_nid=cyberagent_dynalyst&google_push=ASkJ3FbMWtV7IM2lcok9WIK4kK76TC2gK02vniVIfjhVOZQAY2kBGOK31xzPzXQzRozLMl7oGUahOZReB6IZGlublzw92zdnC4iVHhVlXYznMnr6m0VGsW5...

170 B
188 B

274ms
273ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cyberagent_dynalyst&google_push=ASkJ3FbMWtV7IM2lcok9WIK4kK76TC2gK02vniVIfjhVOZQAY2kBGOK31xzPzXQzRozLMl7oGUahOZReB6IZGlublzw92zdnC4iVHhVlXYznMnr6m0VGsW5aA4hVQWaw6CBLG8RXxCq1dqbBlK2Y8dayikg

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=cyberagent_dynalyst&google_push=ASkJ3FbMWtV7IM2lcok9WIK4kK76TC2gK02vniVIfjhVOZQAY2kBGOK31xzPzXQzRozLMl7oGUahOZReB6IZGlublzw92zdnC4iVHhVlXYznMnr6m0VGsW5aA4hVQWaw6CBLG8RXxCq1dqbBlK2Y8dayikg
Date: Thu, 24 Nov 2022 07:06:27 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 18A1
Redirect Chain

https://im.bluevoox.com/pixel?s1=2&s2=203601&s3=m52eksbsgbowze8o&cm=1&rd=1&google_gid=CAESEG-rwrvW20YLUzV-LFgKu-c&google_cver=1&google_push=ASkJ3FYfpXPUd6ji3svX9ONjqMLOSC7saoBxwkEcNPDXgkDZ2yBY_Mvn6...
https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=ASkJ3FYfpXPUd6ji3svX9ONjqMLOSC7saoBxwkEcNPDXgkDZ2yBY_Mvn6D0uE5za-BuvwYlJJ19RqxhxNng-r0jM_PirM-YgZXSY6cOc_vDki58yg9fDa4mSxClQ9LPuK...

170 B
188 B

276ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=ASkJ3FYfpXPUd6ji3svX9ONjqMLOSC7saoBxwkEcNPDXgkDZ2yBY_Mvn6D0uE5za-BuvwYlJJ19RqxhxNng-r0jM_PirM-YgZXSY6cOc_vDki58yg9fDa4mSxClQ9LPuK1FE2wy0Bz8yT248hi-qxK0HXBU&google_hm=QlMuZGUyZS03NTJlLTRiZGItYmM5Nw==

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=ASkJ3FYfpXPUd6ji3svX9ONjqMLOSC7saoBxwkEcNPDXgkDZ2yBY_Mvn6D0uE5za-BuvwYlJJ19RqxhxNng-r0jM_PirM-YgZXSY6cOc_vDki58yg9fDa4mSxClQ9LPuK1FE2wy0Bz8yT248hi-qxK0HXBU&google_hm=QlMuZGUyZS03NTJlLTRiZGItYmM5Nw==
Date: Thu, 24 Nov 2022 07:06:27 GMT
Server: openresty
Connection: close
Content-Length: 142
Content-Type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 18A1
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEPv8YE9wmAyIcmOBg1OFlKs&google_cver=1&google_push=ASkJ3FaFvVuRwQXAR8zNZ9kU3Z6odshUjzGeq36vqCuDRBCsm_zy6wr2ZUS8gdUIR8r382rHAJ...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEPv8YE9wmAyIcmOBg1OFlKs&google_cver=1&google_push=ASkJ3FaFvVuRwQXAR8zNZ9kU3Z6odshUjzGeq36vqCuDRBCsm_zy6wr2ZUS8gdUIR8r382rHAJ...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Gc0lZd0tSRTJ1RWtFZkd4M1dKN0lkdDRTWW1sbEdPVH5B&google_push=ASkJ3FaFvVuRwQXAR8zNZ9kU3Z6odshUjzGeq36vqCuDRBCsm_zy6wr2Z...

170 B
188 B

276ms
276ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Gc0lZd0tSRTJ1RWtFZkd4M1dKN0lkdDRTWW1sbEdPVH5B&google_push=ASkJ3FaFvVuRwQXAR8zNZ9kU3Z6odshUjzGeq36vqCuDRBCsm_zy6wr2ZUS8gdUIR8r382rHAJ3tLiwYx2IhzJbIjsWFfz5fcQHdzYfvkDNEKRLZT85zj06HKqSxuGCtL4Yt-gX6pQwZMxYHNMOKkQs6-DI

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Gc0lZd0tSRTJ1RWtFZkd4M1dKN0lkdDRTWW1sbEdPVH5B&google_push=ASkJ3FaFvVuRwQXAR8zNZ9kU3Z6odshUjzGeq36vqCuDRBCsm_zy6wr2ZUS8gdUIR8r382rHAJ3tLiwYx2IhzJbIjsWFfz5fcQHdzYfvkDNEKRLZT85zj06HKqSxuGCtL4Yt-gX6pQwZMxYHNMOKkQs6-DI
date: Thu, 24 Nov 2022 07:06:27 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 18A1
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEA3iGmQwec9c4yWgjZIM5aw&google_cver=1&google_push=ASkJ3FY_VGlnG32xl...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=Mjg3NjUzMjE4Mjg4NDE4ODIyMA%3D%3D&google_gid=CAESEA3iGmQwec9c4yWgjZIM5aw&google_cver=1&google_push=ASkJ3FY_VGlnG32xlZ8JM_Ecwsop2IZEfr...

170 B
188 B

275ms
274ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=Mjg3NjUzMjE4Mjg4NDE4ODIyMA%3D%3D&google_gid=CAESEA3iGmQwec9c4yWgjZIM5aw&google_cver=1&google_push=ASkJ3FY_VGlnG32xlZ8JM_Ecwsop2IZEfrhTXHxNdknnTZF7bUTQOZmYdq-d9WPhU0oUbOjeMsxbH4zGXawZC2VbllC0lZ_yezWxjKvXLvUP95PZAsUUwG5xuyvdmXaYPTeR9eEl6ZNsmYisW0xqZ_DYp-4F

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:27 GMT
AN-X-Request-Uuid: 40d8bb90-0e1c-430c-8547-0e963708a9dc
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=Mjg3NjUzMjE4Mjg4NDE4ODIyMA%3D%3D&google_gid=CAESEA3iGmQwec9c4yWgjZIM5aw&google_cver=1&google_push=ASkJ3FY_VGlnG32xlZ8JM_Ecwsop2IZEfrhTXHxNdknnTZF7bUTQOZmYdq-d9WPhU0oUbOjeMsxbH4zGXawZC2VbllC0lZ_yezWxjKvXLvUP95PZAsUUwG5xuyvdmXaYPTeR9eEl6ZNsmYisW0xqZ_DYp-4F
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 18A1 0
12 B 273ms
271ms Image
text/html 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J9TTnSrrpJGUQLm47RKXgMNqHM2o4pXPzGpfYH8i8U_VHS_Ui93x-o8MgzE5j0ocGt1pRNHp49

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:26 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 030D 0
0 275ms
273ms Image
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022111501&jk=3715708436332925&bg=!JiWlJWHNAAbvMpMzzzI7ACkAdvg8WgMzVTiIQAeUFDYKyhX1_lEYyaMe7YqT8eDD7O6d0K_G55hYYgIAAACZUgAAAAJoAQeZAsRnC6IfTvisZpjZCdXxEpmXWmcH10vuv6Nj5gM6nmP49hcwTGXTEp68raZaKhebbRxGxwnZaxJA4xCM059YNzZqogh3moawrxzadCcnFffr48Uwvuz6ICqca2YYJGYFAi6XTz0vaKhexCzWTxtBuRcnAZ13bq2RJw0NMnl4XBq_PPfhAmIkqFMgM-H0rtRorexKDGQmWN3lhXPFuKrWnZxLPHHvEPJh7b3OL6yFXqUxQkyOZ9AIVqZi9RyKcVfX25K59lZCgV23yuPp3gmOHid1-So9IJ9U33iCIGKYVPMCBFPw3azejHUDyStimg1SJ3YHX9jRM45PeC6xPzdTxdd2Lk-ObzFQxP56TYUgWNeKLOWnCb6hw_25NpzcupPcRzS8J8Jejlw5OhHJuOEWMIB-dVhx5Za6yZvl-r0FufDu9zcTZDkzAj59jG6LZFm03lYR1L3lt7TbEFYmS9_6I5JyKH7QyA7fNKfy86Fqcjy8BqC4yfq1GVRx_kLxyewo4uv6phQyh-tPpWdCu91WNgAVrShkYBI2YcBnRlpeN8XsfqKNDE1DSEgQB4tj_63m-ROidYJIVPkh4jb1Tz3IgfNbgwDMSvCcdq2kBgoO6u0mHoh2DKoB6geSrev4hcP5tvgs4yJTTGptYs8OJUw4HotYWyM7RkQSoaEooUdaeo5NapPEKJUE6H5TuHb2NmN4kU7NY70HUmuvRJmM554RcwAOm7D_0bpKgzq3uVD-pTyWrjrpmODH84OCPPU0PbokMc3tMy_sXjuNV19uUPpyfyXS2vTslT7Gcu7U96CuhGGGtvKaRiyJ809tCHUoFKIqyzTQfL_ZEHAf51G8NU356s2JIhL9i0Yf_y82Wviu7GA1xLkIlEHiniSFNRb82hSEPf0d3nshydrkv_y6icVSQmREbCTbIkD4XfW1oLAov3Hw7F_81EA
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame A5AE 36 KB
16 KB 271ms
270ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 20 Nov 2022 20:43:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 296595
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 20 Nov 2023 20:43:11 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8A72 22 KB
8 KB 272ms
270ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 113179
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 23:40:07 GMT
expires: Wed, 22 Nov 2023 23:40:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 712ms
236ms Preflight
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bg3.co%2F&domain=www.bg3.co&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.bg3.co
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 24 Nov 2022 07:06:27 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 256770
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 json Show response
gum.criteo.com/sid/ 341 B
648 B 708ms
237ms XHR
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bg3.co%2F&domain=www.bg3.co&cw=1&pbt=1&lsw=1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

9fac049f56dcbea7c18cfb26c0c9a49df1598b46abd38f49d09aa3b0be076ee5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1310956
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
541 B 434ms
142ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 53e91d069840f4f3f8bd5fd4e5fb61b5dde40b68b4a2a923289dbe74a283328c

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 24 Nov 2022 07:06:27 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Sat, 24 Dec 2022 07:06:27 GMT

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 9D0B 9 KB
4 KB 1133ms
374ms Document
text/html 52.84.45.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.45.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-7.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 55240e190af93c329c339c44aef4e37701f7cac83c65df0afb7e801b7eead39f

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 52621
cache-control: max-age=86400
content-encoding: gzip
content-type: text/html
date: Wed, 23 Nov 2022 16:29:27 GMT
etag: W/"02a59c9399d935f64b331e61178d2c9f"
last-modified: Mon, 14 Nov 2022 16:28:27 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 d61097c4bb79608bbb315ab823bf79e4.cloudfront.net (CloudFront)
x-amz-cf-id: _lZiyANWKOBdGo6gGDa-9mZBtWzL1LbGhG4nV4mIOR9McoDEh6m9IQ==
x-amz-cf-pop: MRS52-P1
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:9114884f-60db-4078-afb1-cde242f68696
x-amz-meta-codebuild-content-md5: 3d437d58b8bd54e8a0e378e97cd0e39f
x-amz-meta-codebuild-content-sha256: 85fe75fc3aebfc86893a7760fc0ac12e3ff269743874600311aae7eb8917fccd
x-cache: Hit from cloudfront

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 2BDC 281 B
554 B 751ms
247ms Document
text/html 23.58.244.87
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.58.244.87 Cyberjaya, Malaysia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-58-244-87.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 24 Nov 2022 07:06:27 GMT
ETag: "40010-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 pd Show response
u.openx.net/w/1.0/ Frame B210 533 B
633 B 251ms
242ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: c0ad65a591038eb3bf8596c017c0deb30f5b06b82ec540f9a8a1401660c8191d

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 322
content-type: text/html
date: Thu, 24 Nov 2022 07:06:27 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 4AD3 36 KB
12 KB 938ms
360ms Document
text/html 23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

f5261e6b5b77b5291e0122f9f72c8be1e4d805eefb45bfc7d0f526315dc29ca6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11836
content-type: text/html; charset=UTF-8
date: Thu, 24 Nov 2022 07:06:27 GMT
expires: Sat, 26 Nov 2022 07:06:27 GMT
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 5493 1 KB
2 KB 242ms
236ms Document
text/html 52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: b156bbf7daafaa2a7c2ec3f1bf3b887df0d6d83dc622a7850e123cdf01aeea52

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1143
content-type: text/html; charset=utf-8
date: Thu, 24 Nov 2022 07:06:27 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 880D 3 KB
2 KB 388ms
130ms Document
text/html 104.18.36.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 265
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 76f04d500c491c62-AKL
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 24 Nov 2022 07:06:27 GMT
expires: Thu, 24 Nov 2022 11:06:27 GMT
last-modified: Mon, 25 Jul 2022 19:18:30 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 3603 4 KB
2 KB 398ms
393ms Document
text/html 51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1669273582776

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

983666cb327a82f18f2dae4439fecbf9c9a9ecd7b46eea7c9316c5d3f579efc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1375
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 239A 52 KB
17 KB 466ms
152ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 8060
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 24 Nov 2022 07:06:27 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 04 Nov 2022 04:41:58 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 30, 242315
X-Served-By: cache-lga13626-LGA, cache-mel11225-MEL
X-Timer: S1669273587.278111,VS0,VE0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DD7D 42 B
64 B 290ms
289ms Fetch
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvThDvNGzeZdWPMi2Grmafv-fKreNpdswftB1_Pj_vZI4yDuUF5L1Ys8BG-yDsLEK0lf2IGO3PwxzdE5Pc1ii3j9WARN72AzTh3N4z_Mqd2Y5VAncMNnoIo3oQw-BpXuyEONTo&sai=AMfl-YQu2v3gtLYq7InUXqLaCkLK9gu9c-WcefEg4W8y2fakspfI9HB_omSF1Ay2p6EJ55a2kvvhR0LzFZDUrvF2V3npRpfsuuqDd6McW9QqLLDpQh3InXOC2pKZb8wp0vw&sig=Cg0ArKJSzH7Bytrq7Ie_EAE&cid=CAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM&id=lidar2&mcvt=1000&p=60,450,314,750&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=1420297610&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669273584647&rpt=1291&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 8A72 36 KB
16 KB 271ms
270ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 20 Nov 2022 20:43:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 296596
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 20 Nov 2023 20:43:11 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 5493
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3658&xuid=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&dongle=0cfd

37 B
353 B

238ms
236ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&dongle=0cfd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 24 Nov 2022 07:06:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://eb2.3lift.com/xuid?mid=3658&xuid=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&dongle=0cfd
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 209

GET
H2

200

ebda
eb2.3lift.com/ Frame 5493
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NzAyNzg0MDM4NDkxMTczNjI3Mzg4
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

236ms
235ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 5493
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEP3wAoxMzALeVPz0fcMrjQE&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
353 B

237ms
237ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEP3wAoxMzALeVPz0fcMrjQE&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 24 Nov 2022 07:06:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEP3wAoxMzALeVPz0fcMrjQE&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5493
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NzAyNzg0MDM4NDkxMTczNjI3Mzg4

170 B
188 B

274ms
273ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NzAyNzg0MDM4NDkxMTczNjI3Mzg4

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NzAyNzg0MDM4NDkxMTczNjI3Mzg4
date: Thu, 24 Nov 2022 07:06:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
p.adsymptotic.com/d/px/ Frame 5493
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=702784038491173627388&dbredirect=true&gdpr=0&consent=
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=702784038491173627388&dbredirect=true&gdpr=0&consent=&cookiesTest=true
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=d9fd00a8-f70c-43e4-ab10-6973378ca5e6&_noobservation=1
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=d9fd00a8-f70c-43e4-ab10-6973378ca5e6&_noobservation=1&_expected_cookie=df68d87...

43 B
164 B

242ms
240ms

Image
image/gif

104.18.98.194

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=d9fd00a8-f70c-43e4-ab10-6973378ca5e6&_noobservation=1&_expected_cookie=df68d873376048195c0e34baefc2e5f6
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 104.18.98.194 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP='NON DSP COR CONi OUR BUS CNT'
date: Thu, 24 Nov 2022 07:06:29 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 76f04d5b9886aac3-SYD
content-length: 43
content-type: image/gif

Redirect headers

location: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=d9fd00a8-f70c-43e4-ab10-6973378ca5e6&_noobservation=1&_expected_cookie=df68d873376048195c0e34baefc2e5f6
date: Thu, 24 Nov 2022 07:06:28 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 76f04d59ed91aac3-SYD
content-length: 0

GET

receive
pixel.tapad.com/idsync/ex/ Frame 5493
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=702784038491173627388&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=triplelift&user_id=702784038491173627388&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=aa83cb34-48e2-4a27-8473-dc326e7ece18&ssp=triplelift&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10529556667241751076&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vi...

0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame 5493
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/702784038491173627388?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-j93vzpdE2oSk0vrgoMgOHEAp6V4tXYlUOie7EcTzCQ--~A&dongle=0883

37 B
353 B

238ms
237ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-j93vzpdE2oSk0vrgoMgOHEAp6V4tXYlUOie7EcTzCQ--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 24 Nov 2022 07:06:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Thu, 24 Nov 2022 07:06:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-j93vzpdE2oSk0vrgoMgOHEAp6V4tXYlUOie7EcTzCQ--~A&dongle=0883
content-length: 0

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 5493
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=702784038491173627388
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=702784038491173627388&dcc=t

0
0

524ms
359ms

Image
text/html

209.54.182.161

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=702784038491173627388&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: HTTP/1.1
Server: 209.54.182.161 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: AV4F4T1JHGBSYV85FDS1
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=702784038491173627388&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 c.gif
c.bing.com/ Frame 5493 42 B
668 B 577ms
287ms Image
image/gif 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=702784038491173627388&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS: a-0001.a-msedge.net
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
last-modified: Thu, 13 Oct 2022 15:58:17 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BAA1AB9856E04393868F95C26FE1C766 Ref B: SYD03EDGE0905 Ref C: 2022-11-24T07:06:28Z
etag: "e997be9b1cdfd81:0"
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type: image/gif
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame 5493
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent=
https://eb2.3lift.com/xuid?mid=3335&xuid=2876532182884188220&dongle=4d58&gdpr=0&gdpr_consent=

37 B
353 B

240ms
237ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=2876532182884188220&dongle=4d58&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 24 Nov 2022 07:06:28 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:27 GMT
AN-X-Request-Uuid: 76d69e35-3898-4407-b02d-75ac89f344ad
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://eb2.3lift.com/xuid?mid=3335&xuid=2876532182884188220&dongle=4d58&gdpr=0&gdpr_consent=
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B210
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=7344326985183242848&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

237ms
236ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=7344326985183242848&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=7344326985183242848&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B210
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=9202fbcc-f3e2-7e90-f7bc-786e8245e0e7&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=9202fbcc-f3e2-7e90-f7bc-786e8245e0e7&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&ttd_puid=9202fbcc-f3e2-7e90-f7bc-786e8245e0e7&gdpr=0&gdpr_consent=

43 B
62 B

239ms
238ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&ttd_puid=9202fbcc-f3e2-7e90-f7bc-786e8245e0e7&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&ttd_puid=9202fbcc-f3e2-7e90-f7bc-786e8245e0e7&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame B210
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=openx
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y38X88Co5s8AANu0IvMAAAAA

43 B
106 B

237ms
237ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y38X88Co5s8AANu0IvMAAAAA
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 0
Date: Thu, 24 Nov 2022 07:06:28 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=openx","cluster_id":0,"gdpr":false,"ipv4":"116.90.74.202","key":"Y38X88Co5s8AANu0IvMAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad224"}
X-SO-Key: Y38X88Co5s8AANu0IvMAAAAA
Server: nginx
X-SO-Upstream-ID: m-ad224
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y38X88Co5s8AANu0IvMAAAAA
Cache-Control: private
X-SO-HostName: m-ad224.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 118
Content-Length: 0
X-SO-LB-Hostname: a-tgng40011.dc2p.scaleout.jp
X-SO-IP: 116.90.74.202

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame B210
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AQxBvtK_mILYks8ADxwUvEI6cc8AAAGEqHWRgw

43 B
114 B

240ms
236ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AQxBvtK_mILYks8ADxwUvEI6cc8AAAGEqHWRgw
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
via: 1.1 73a569eafe77b39b17f3e8ef76c14c7c.cloudfront.net (CloudFront)
server: Logicad
x-amz-cf-pop: SIN2-P2
x-cache: Miss from cloudfront
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AQxBvtK_mILYks8ADxwUvEI6cc8AAAGEqHWRgw
cache-control: no-cache
content-length: 0
x-amz-cf-id: GjWQHm7J8c9RJGXJ1YCwjaH76ECKXoox20JOM3W8FwivpExNKAwU6A==
expires: -1

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame B210 170 B
188 B 277ms
274ms Image
image/png 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YmU2ZDI4MDYtM2E5NS0yMDM0LWUyNWMtMjJkNzQ4YTcyZTg3

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B210
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBw9JYR-CbVQYbNOiEdaqGU&google_cver=1

43 B
61 B

238ms
237ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBw9JYR-CbVQYbNOiEdaqGU&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBw9JYR-CbVQYbNOiEdaqGU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5AE 0
20 B 277ms
276ms Image
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BIOUd8Rd_Y5GYGJOE9fwP2fCeiAIAAAAAOAHgBAI&bg=!np2lndnNAAbvMpMzzzI7ACkAdvg8WqmdY32PpJze4uPEfmlqJtYzdr4y8wNqmJrZZkpY7fFGb8nY5AIAAABoUgAAAAJoAQcKAHlmJbguqPZn6pGwIaY4widq-3_WRYL4Y78kz0sAgcUcP-EZsCjnEBvj5E8YzEMCpTU7tRp10wzgckUVviB6zruBDid5z1NGscpnnIp7RUKl31HCnlnQVim9RBQhYHIGHWqckdzIVaWHzAViPF1vD7lvq7t5MrE2uH34mQLjMSymfALNfETMaGrCHE-Td62R-KKgPe_WJ2OvhwlE3sAp3LXtGiiKsu8b18tCDtaTx_JkeGrSRl8Bnh3QNiyDgGM-fo0Yfdh0x8L2XvQXmSTfysL9bGQMsGucy-w9vF2q3VOu3uwbKIKJ1jKlvKXdpRSTRE25iRdicND98QBAFBqmjHE87Xy3cAK58wJINNXr1PtX_On6TdDFEQN1JeoKeJGq1z9NbfD27Pty6OXpSISRZD_3qrFp0wnTcTZzx1Rc1MGfoBlfuZ3yj9utxgW3N_xtKL8yQF-4JmYWkCqLSjHtudptVTeQDSDQn3nekOqAUNyblAekWIo4D47p5j0oIAp90NEszqGXMbwdSuf5z1of_OHm5pn2xUAwZWY4bYtO49gIZaQND-eool7CLioHgJxgBSoA8fTAxX2jqqeCBefGzF6trP9Ociqd64_UguC2c9G6GblwKroK06NkQypGDnK2RVFDVm2_hEPTO_XHmN-99JY-L0zX5sAJY-89tggNJNkyFkHCqS3bvJeTu5-20HdFd0L-p9yA47_lp388ew2XHW7CuuZ2yoAsYLMvV-8MCqRwVTRB1XfB3mLHIv4h8kZSPs166DKrbUtrW6VVf7vAVwdMhmp08t-V6YQKmGeKjxE7gv_Gn3DMOaPcU5r7pmAISlMwH8lFZskmBJLCAbEDUV3gz3c1KXkV8z4-oz3Sr7sM1jyVzb4NHG7WdwjCUD4fRtcpcmBXKP2nO7o0kBk2SXi0t8W45zoVk9TiLdYDWEFNqg8vD9pxT0_ejCIuEyS8XI3Zbj6AvGO1LJ3ZINnf_cftLeJjhQ35KYvIIE0v7M35hGO8bB1_6ejLpIYzoKqODsa2uUZXtI7JKjXz_pz32knH18cZoggf34u6kEKzNiFMRBgLzw67SIpdzBpg98yq9N3VW9USJQN3TnF52OVHKiDlBYMuWB6yXh6v4bZwSpC18uFTVYWegf8eFM4-LF-8IA

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3EB8 0
20 B 273ms
273ms Image
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=dbg&cor=12381268080485554492&x=1&ct=76&dl=2&ds=1

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame AC84 1 KB
1 KB 623ms
368ms Document
text/html 172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 664fe3351f21d3e8fc10911e21f15d372be17968f1135097029dab9c744053ec

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 76f04d528e8b1c5a-AKL
content-encoding: br
content-type: text/html
date: Thu, 24 Nov 2022 07:06:27 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eaVikda%2BC46gy0Qp0215hnnQtnev3NMNFhFcxGTQvKnfVw7%2FQwtIL0xaUguE5s%2BcxdyOhxJ52Cj1i6imH%2FG9%2FQTOKeRATmpidi0F1GX6VAFYzTOehw%2B%2B5KSfaoAMiOclkq1UT3JuthpuEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2

200

/
onetag-sys.com/match/ Frame 3603
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=4530637f-17f3-4200-a95e-1762d5389708&gdpr=1&gdpr_consent=

0
291 B

393ms
393ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=4530637f-17f3-4200-a95e-1762d5389708&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Thu, 24 Nov 2022 07:06:27 GMT
Server: MT3 169 32252b7 master hkg-pixel-x18 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=4530637f-17f3-4200-a95e-1762d5389708&gdpr=1&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 24 Nov 2022 07:06:26 GMT

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 3603 0
239 B 1692ms
387ms Image
image/gif 69.173.144.139

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame 3603
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=2876532182884188220

0
291 B

395ms
394ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=2876532182884188220

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:27 GMT
AN-X-Request-Uuid: 6823b4b4-883d-4156-abcd-c162278feb65
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=2876532182884188220
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame 3603 42 B
679 B 239ms
237ms Image
image/gif 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=EMV7CrvZto6YRLA4iJCJnaWBxeJidsBgIUbHKzsoPY4
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 030b4ddd4a4f3e9891a065664f20c4bb
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3603
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhKh1jyfwysvH6KvUVT_Cg-CNJJbueUwJ4g

170 B
188 B

278ms
276ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhKh1jyfwysvH6KvUVT_Cg-CNJJbueUwJ4g

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhKh1jyfwysvH6KvUVT_Cg-CNJJbueUwJ4g
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H/1.1 200
OK sync
ssbsync-global.smartadserver.com/api/ Frame 3603 0
75 B 844ms
241ms Image
text/plain 23.106.127.165
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.106.127.165 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:27 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 3603
Redirect Chain

https://id.rlcdn.com/711916.gif?ct=4&cv=
https://id.rlcdn.com/1000.gif?memo=COy5KxoNCPOv_JsGEgUI6AcQAEIASgA
https://onetag-sys.com/match/?int_id=110&uid=

0
291 B

395ms
393ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=110&uid=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

date: Thu, 24 Nov 2022 07:06:28 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://onetag-sys.com/match/?int_id=110&uid=
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 3603
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=984pnNtmNI4N4XHXKGw99d0FiLjDmMQC33n3BE65WXo

43 B
479 B

1067ms
343ms

Image
image/gif

209.54.182.161

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=984pnNtmNI4N4XHXKGw99d0FiLjDmMQC33n3BE65WXo

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776

Protocol

HTTP/1.1

Server

209.54.182.161 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 16SMW0X07ZS2CXHZ0YQR
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=984pnNtmNI4N4XHXKGw99d0FiLjDmMQC33n3BE65WXo
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 3603 0
42 B 712ms
235ms Image
text/plain 103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:28 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 3603
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESELwip3yPgokJPUvSJ84Cjdo&google_cver=1

0
291 B

396ms
396ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESELwip3yPgokJPUvSJ84Cjdo&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

ec2-52-74-13-196.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESELwip3yPgokJPUvSJ84Cjdo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58488/ Frame 3603 0
38 B 241ms
238ms Image
text/plain 52.74.13.196
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.74.13.196 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.25 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:28 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 3603
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&gdpr=0&gdpr_consent=

0
291 B

432ms
432ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://onetag-sys.com/match/?int_id=29&uid=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 233

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 3603 43 B
235 B 286ms
285ms Image
image/gif 35.213.12.39
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669273582776
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.12.39 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 39.12.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 24 Nov 2022 07:06:28 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 239A 0
743 B 334ms
333ms Script
text/html 68.67.179.155
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.155 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:27 GMT
AN-X-Request-Uuid: 7309b550-bcb6-4d53-ba4e-6c487df398cf
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C3D4 0
0 584ms
283ms Fetch
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss8qXin3LyaoysXqLoJtq7ZPuxbjQ-T_Yel6of_A0JYfwjstxPXpsbIdS2vbAiy2BkaR721UjkX7yPx5QV9xK7W1xr1jnao6gLw-CbF3l2JHor7F5uChsJ22ruM0-MvDZnT6TBFofUHYacGqBqYqyuznz-shLl3ROkcAJWkGGQbC-JBXUytDW7Maqj97GTnT2-KRiyDr6zcxsSVxL_edetCcY6IgCTapsQ6l-kly8Js_nJpMJDSmvsXvXNxoUXY9LCuVGNNqQB3QJ4_8_aUdQDtivWXFuJM0DZhjvcwtZsdmWhTnmYtu6bwLhYSBdvbKKkO8_vTLUHfc2PgpS1olL2dPz8BkFJpG6OJx6P3sMCtX9ZynJa_Vu1E5vw-wNKLW4aXDHs7uJqeIbLP-XdX0Qpfjn5XfbPIp2oUPEQvwkUYqHq4cvbmlrJ8VQy9D9rZsewn0rvVeNXsJFVkA8QZihcUw9KjjO9rm8_PP5cNENY66YCULSDgwlKmhd5ItVm_GAIAukciycH0uRPZ-S-nLLbHv2YZ2Xn3MiXrm0n5tYaGf7teMaP8rG94ADeW8y_VmTbTwZURo1o7W9xN6nuRU2KB9xXx4a75P3kHZrBQiL-K1C8kzQeDpHlDtKJNxy9SCgC263hBEzVNLRmqw-yBMDpTlpgoBytHvPfTmp9RcMM7uf1QWU-IgyKoQdGo3dEpg-W5zP8zxykFUiqR9MpEt6az-yz2OxthrzUEQjujsDFo9AkrPofD1D0_MxKLn07V9UWjRZFhpOGYmBxP_YF2Un048fIIH16DEIUmgKJ8LTa2tZP2LfJPw4Xbyf1bI9YPKK3g8kjWj-Mu764wkMMDeroi-3n9bO0xc5cSQvldNnzZ1GEUCHVKhh84uy_dwi01u47oX0a8FWAcS7jFjNlnDJlYZa7Mgl_qGk-1NMDroA31YqppmwtvW74hoKX2xPzaAZCOgG6Y7By2czcLeIlhuEYwfq53OvHfk2yDjGmJBZTnvE6ZRSgi772aKWkSrQkJURj8U7YCc8MOJwXWm6aDQGOa7ik8k7-JY0y0cwtkiYcWowTGI76GIYHsvU_msA8hIvZGU5Ke1CO5bpIBfrVHbLgPf358UxYTf1YRRz2ue5AQiJA4ov5IlzP_h3XgM9PuhM9-wz_V5ZkWNDS_ZXNRJhPwQU3mFiiwMEONKZ4gzqBmxOQCONVXJLQH_td8KiK9BBnspACjkgTogyEomCKDhI4NdAT2pbs&sai=AMfl-YTcEb02DircBeOdy2q71rh8xTsdh02do4cKMlyS11LmD1l_iemh6IU8Jca2EfAmLGkbFJ-twTysNObOirl-ay70RPN2iZZyGsxpgU3TvAGDIY9iiRT4IPA4Dv4N4UNli0aiGfR3jqu4yR7fQhkd0Ql2jIQTMGrvKaBkawPGOEsgwTrzj9-yKiU27xRCbInxD1nGE0VHoOzg097ZNZUVcTZTnkfflILLYFgJ0C_UnY25tl4Me5V44__NQ6NrBFa4GDkBEOKXRWxfEg&sig=Cg0ArKJSzPRXqZlKTIZ8EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1569&vt=11&dtpt=1568&dett=2&cstd=0&cisv=r20221110.27135&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 24 Nov 2022 07:06:27 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8A72 0
20 B 275ms
275ms Image
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BYd6C8Rd_Y9mYLsWNwgPzqLvoAgAAAAA4AeAEAg&bg=!09Cl0JTNAAbvMpMzzzI7ACkAdvg8Wh2PVBDCnkqrNaIO8ilz4u4xp96MJ64FoJWAbw2I86Tx2UUflQIAAABzUgAAAANoAQcKALhA8TTeUV-A6GLuYBSAM9R2iMHYR0RDSNVqSL1wks-UHYR1TQnKbxuYM5azOUFp9k3L1SQiDV0DFAoG3RbAG5rLts-UuMYaaAUmcrp7os5gGthPTOTtgtHbaHHn2PS5QHoW2JYuC81xoMpJKQRaGh4wbXltkGmGAvZwWV9WC_5mEIJcrqdDH8JeulEUpC6sliWDOxaLRdMy-jfEhLzanK_2fRrNPhzYHDN8zuUGwjMTnCzzzbVitkV0mQLd0-l71_Io37QNdyxrjq41pL_XYQi_fyw4GLAQz4ig3SqD619xJI2NjMHDS6svZz_2p4kiLrYIV7RIg4Twr8owXavVkkwdFg7YTJf1V7TY6thvgLE1KmFeGj2L-X6SFLDm-8dItx7kh3BTTYlrEBdZk8RvavexTwj3zw7xeooxcta57osGq53bF4iGJhPoLxDk4PiAS-wTpS8NjgV36D52bk1u9-ggDMvntc6jPA-24qvvE25liNqjPiCjcKZ0N03pnkP4do0uJGd-Dpd6cHAdVnPYfHHecehbtXQBxRkjpohtvF2C7xUqQDo6FHY0fNAu8f7gym2rlaBhaFxHGAqNHorJR7aecfqFLJsRPOm5O9aHN0oPH8ArBKQMLXzxke4ROcKlelM_c8Jb_Uf1B2dylwHZqyRMN0PGwbgL1G_PrFe8KYlEA29DYmUvHUdB3czId3YXZzQQZEXh7C0pY2ryAN4v1Yun8t9SEGz4uiRIEBwJf3nsyzxakI2GvFP8ytfS0mrc24bvBenlA9H0afJy5g9S8ROmZn5e-NWzPEgo90kl2KASg1Yg20WPjjW1XgUucYk-NEMOmJhCVeyOravBr4bOQNzyhLwhlQ2aCtEeFKOvxoMxTF06T3PhIecP4-h7ykvC7qVPsakJ08xGgYcF7WJ7M57EQf0PR7dUia0gkGaCLUifaan5UPMfS4vuydbSrR1tr58HarVAHXIVaqjsIJUX0Ti0dsyCo3rtr8c0yRWYcFDkxTGJws3LVRcf16HRvpa-k4Ctcv0mv_Me8onVOO76hlBKZtxzEmAE26J0AtXhNSVjN9k3rNNEDtBZT1pDRPmqRg2fd6sIhNeKorYc9kef3p4Wf8nX_zhJZKJI0hXDiXgsQj2xbe-_hEKW73bj2jDeIvAbz0IkpspHoV3q0Qw77qI1EOozgmRKuQmlA59we4vBiCm7t5nACvs7f3--fwTf5PVZ0AX91oYitw

Requested by

Host: 1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com
URL: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3EB8 0
0 585ms
284ms Fetch
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssHVs2TL35OBL6QnEFtETNYB2MyEPw7eRld0TzjfTQJNPHG-DQeTHEKIokenuZpLePs4esAHjte4KaIp_3SeWf03DmPmpD-Y9P4rNGdEoMIB0bZZH-OgSU1bZFdjQoE9YY0l0VowrD9G-ovo-Cf7mNg0GzUryjyLQ52ifm6PHM2IlHAinU7fwKEASdjZbq8RxVP5PeZbM5XqqGobWCcLUwu285GhNS9aPrA5ewwhcJobUFz82zG7SXt6mXRuEHL87pzDeHPUZZ8qn30kV2RwZBhpA4nt3uYADILFOLzljWndg7pGkNXtkD2ECXr6RPv0IKAMLRNzZZ2wmgLpt314vnB_lXubApoYQJSLTdawQiJ_Jo0Z_edsxajKZkHQSztGXu5pMwDGAJGigxwdotgfZGfShiEvFixdEJojOW80f-GrArZtpJfXYe3InOBEGmyRx4MinM56_oSKRvhqQOoK44BtP6erqDb__FZi7J7JcNTXlLDujQRudc_NidWb_iXQi6JrcgtBhwvwjAC0Tv2fIClFHWpIXXM1eWEYD5uRvNMKrSqh5lOYZ1Q0SCzqcjNIOIUBWLF3cntSMMoEoDZsUfREYorYLSxfCBxvGSbq4Vdae34j1jnt-x58E4e_GvEcJgn9nXcEWuTnvCeAocRpmhlyvwYprJXm1rmwagX8KWO0grPLD_K5UIAoN7P82rlphHlqIk3XqpaSC8aV0_ShrWhrWwmmjKhxS742HxUg8ltG4PPONarg7cyEHxxLIVgU_au6P9JF9LOMvlEfnLiL7wzIWyfOzJZ7idgn9zOacUpLiSIpPCOqlEZ09dnGSKFzmhdb0DjzimRwvkWgOqJRHA7121QSgvPTCuC4BM_fz-fMdiYrE3aOjFLdXuFnChxIpkSztnKg_Xzm3sG0nSqa7rS6C5exFSwm8TVTNbiajNuVoWClse7rwuoY_wgBbh_60JtAGJfSiFQFWSxK_D-rKnTtfMFxKn5SvOT9UcisQQxFpkbAOX_NqNu3BnP1kcZmdHP0pJiz8qwx1OBHm8g0FuAx0oLK2pc4H8clQxoMA8TegGl18ahUE-8cHGB8Ak7H8RHCMdvfFi8_FO4LbVPGGpK2Va5ry3XIVbK0v_FrISsuz1S_9SfsNdl4zFdZB9Vk9QynR5LwELJySRNTnE2B7DvoO0g0s7z_NpgpvTGP4vzqQ0p3sraGKvKO0ukUzkVOxiKriBAMzxAn-87NCC1xHqFC9nlHWldkDYzSQ&sai=AMfl-YQqGxzAvu4f3cPXoV93UEbEQHUAqhuT8J0Atdf2YbiT-YeZ3zwm6jdLd2Qrx-8_3zvzCGhFBZyld6S-AeaCkfoEfzEB-9DmMU0AdxJQnjARSYnAYo5pb4W4sMDKDOWUgIz4T-v3GfoJNMOVWKbyVQIg_U4LYkWY6bFPhfcxrSJRciPpuFpv7BSjeaD8dJd8GRglkQcJSHOLLyq9_bzyjbLVC2p703vIaCCcC3wAcogFQ1mv73qVQczRmc4uq0NgR3bbUvJ-Q0lqcw&sig=Cg0ArKJSzBKpcbl9aecPEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1469&vt=11&dtpt=1468&dett=2&cstd=1&cisv=r20221110.41223&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 24 Nov 2022 07:06:28 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 2BDC 34 KB
10 KB 246ms
245ms Script
text/html 23.58.244.87
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.58.244.87 Cyberjaya, Malaysia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-58-244-87.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: b845f1b1d8dd4688c9b8b4d8c32754103d04d7bfe718a67bb8c15f5346eb2cae

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 24 Nov 2022 07:06:27 GMT
Content-Encoding: gzip
Last-Modified: Wed, 23 Nov 2022 15:34:37 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=30456
Connection: keep-alive
Content-Length: 10066
Expires: Thu, 24 Nov 2022 15:34:03 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 4AD3 61 B
301 B 441ms
237ms Script
text/javascript 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=&j=window.advBidxc.mnetRtusId

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 854039
expires: 60

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 8E20
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=medianet
https://eus.rubiconproject.com/usync.html?p=medianet

281 B
554 B

515ms
267ms

Document
text/html

23.58.244.87
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=medianet
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.58.244.87 Cyberjaya, Malaysia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-58-244-87.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 24 Nov 2022 07:06:29 GMT
ETag: "40010-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 24 Nov 2022 07:06:28 GMT
location: https://eus.rubiconproject.com/usync.html?p=medianet
server: AkamaiGHost

GET cm
p.rfihub.com/ Frame 0812 0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame DAD5 15 KB
6 KB 734ms
241ms Document
text/html 23.72.44.196

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3122751877444267000V10%26type%3Dpba%26refUrl%3D%26vid%3D92735878483122751877444267000V10%26ovsid%3DPM_UID
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.72.44.196 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=78587
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Thu, 24 Nov 2022 07:06:28 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 25 Nov 2022 04:56:15 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

cksync.php
contextual.media.net/ Frame 4AD3
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3122751877444267000V10%26type%3Dapx%26refUrl%3D%26vid%3D92735878483122751877444267000V10%26ovsid%3D%24UID
https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=apx&refUrl=&vid=92735878483122751877444267000V10&ovsid=2876532182884188220

45 B
452 B

279ms
279ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=apx&refUrl=&vid=92735878483122751877444267000V10&ovsid=2876532182884188220

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 24 Nov 2022 07:06:28 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 24 Nov 2022 07:06:28 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
AN-X-Request-Uuid: 8f02b1ca-2a05-4876-878e-c61f06cfa123
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=apx&refUrl=&vid=92735878483122751877444267000V10&ovsid=2876532182884188220
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cksync.html
contextual.media.net/ Frame 4AD3
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3122751877444267...
https://contextual.media.net/cksync.html?cs=8&vsid=3122751877444267000V10&type=opx&refUrl=&vid=92735878483122751877444267000V10&ovsid=5a2e9253-58e2-4470-94f3-060030aa723b

219 B
219 B

314ms
313ms

Image
text/html

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3122751877444267000V10&type=opx&refUrl=&vid=92735878483122751877444267000V10&ovsid=5a2e9253-58e2-4470-94f3-060030aa723b

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 24 Nov 2022 07:06:28 GMT
server: Apache
vary: Accept-Encoding
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: text/html;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 219
x-mnet-hl2: E
expires: Thu, 24 Nov 2022 07:06:28 GMT

Redirect headers

date: Thu, 24 Nov 2022 07:06:27 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://contextual.media.net/cksync.html?cs=8&vsid=3122751877444267000V10&type=opx&refUrl=&vid=92735878483122751877444267000V10&ovsid=5a2e9253-58e2-4470-94f3-060030aa723b
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cksync.php
contextual.media.net/ Frame 4AD3
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3122751877444267000V10%26type%3Dmma%26refUrl%3D%26vid%3D927358784831227518774442...
https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=mma&refUrl=&vid=92735878483122751877444267000V10&ovsid=65ec637f-17f4-4200-8019-85b0f05d6157

45 B
465 B

285ms
284ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=mma&refUrl=&vid=92735878483122751877444267000V10&ovsid=65ec637f-17f4-4200-8019-85b0f05d6157

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 24 Nov 2022 07:06:28 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 24 Nov 2022 07:06:28 GMT

Redirect headers

Date: Thu, 24 Nov 2022 07:06:28 GMT
Server: MT3 169 32252b7 master hkg-pixel-x26 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=mma&refUrl=&vid=92735878483122751877444267000V10&ovsid=65ec637f-17f4-4200-8019-85b0f05d6157
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 24 Nov 2022 07:06:27 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 4AD3
Redirect Chain

https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3122751877444267000V10%26type%3Dr1%26refUrl%3D%26vid%3D92735878483122751877...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6008562723
https://sync.1rx.io/usersync/tradedesk/f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa
https://sync.targeting.unrulymedia.com/csync/RX-f256db65-b2d3-4798-ae52-901f8291d64a-004?redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3122751877444267000V10%26type%3Dr1%2...
https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=r1&refUrl=&vid=92735878483122751877444267000V10&ovsid=RX-f256db65-b2d3-4798-ae52-901f8291d64a-004

45 B
471 B

274ms
274ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=r1&refUrl=&vid=92735878483122751877444267000V10&ovsid=RX-f256db65-b2d3-4798-ae52-901f8291d64a-004

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 24 Nov 2022 07:06:29 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 24 Nov 2022 07:06:29 GMT

Redirect headers

location: https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=r1&refUrl=&vid=92735878483122751877444267000V10&ovsid=RX-f256db65-b2d3-4798-ae52-901f8291d64a-004
date: Thu, 24 Nov 2022 07:06:28 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXf256db65b2d34798ae52901f8291d64a004
content-type: text/html

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 4AD3
Redirect Chain

https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MzEyMjc1MTg3NzQ0NDI2NzAwMFYxMA%3D%3D&google_sc=1
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEL9YE_0gKPvAon26e8xGwUQ&google_cver=1

45 B
610 B

855ms
285ms

Image
image/gif

23.36.252.26

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEL9YE_0gKPvAon26e8xGwUQ&google_cver=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Server: 23.36.252.26 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 45
X-MNET-HL2: E
Expires: Thu, 24 Nov 2022 07:06:28 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEL9YE_0gKPvAon26e8xGwUQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 4AD3
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3122751877444267000V10%26type%3Ddxu%26refUrl%3D%26vid%3D92735878483122751877444...
https://pm.w55c.net/ping_match.gif?scc=1&ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3122751877444267000V10%26type%3Ddxu%26refUrl%3D%26vid%3D92735878483122751...
https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=dxu&refUrl=&vid=92735878483122751877444267000V10&ovsid=Vnlr8Oy81OY6jy5

45 B
452 B

281ms
281ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=dxu&refUrl=&vid=92735878483122751877444267000V10&ovsid=Vnlr8Oy81OY6jy5

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 24 Nov 2022 07:06:29 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 24 Nov 2022 07:06:29 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/595ea14#595ea1444a96c0bdac4aa333a73d7028cf966fc7 i-052f9362e060162a9@ap-southeast-1a@dxedge-app-ap-southeast-1-prod-asg
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3122751877444267000V10&type=dxu&refUrl=&vid=92735878483122751877444267000V10&ovsid=Vnlr8Oy81OY6jy5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 4AD3
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=115&p=226&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=8a8cd45a-e736-4624-b36c-55eec22e09a0

45 B
615 B

274ms
274ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=8a8cd45a-e736-4624-b36c-55eec22e09a0

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 24 Nov 2022 07:06:28 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 24 Nov 2022 07:06:28 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=8a8cd45a-e736-4624-b36c-55eec22e09a0
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 959860
content-length: 0
expires: Thu, 24 Nov 2022 00:00:00 GMT

GET

cksync.php
contextual.media.net/ Frame 4AD3
Redirect Chain

https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=medianet&ssp_user_id=aa83cb34-48e2-4a27-8473-dc326e7ece18&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=74&&user_id=171250298&expires=5
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=aa83cb34-48e2-4a27-8473-dc326e7ece18&gdpr=&gdpr_consent=&gdpr_pd=

0
0

GET

/
b1sync.zemanta.com/usersync/bluekai/callback/ Frame 4AD3
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3122751877444267000V10%26type%3Dzem%26refUrl%3D%26vid%3D92735878483122751877444267...
https://stags.bluekai.com/site/23178?id=G1jKn2iRNBZ8ELSCPPF3&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPKHGFVEW3RSNFJE4QS2HBCUYU2DKBIEM...

0
0

GET sync
rtb.mfadsrvr.com/ Frame 4AD3 0
0

GET um
cs.emxdgt.com/ Frame 4AD3 0
0

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 4AD3
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa

45 B
621 B

274ms
266ms

Image
image/gif

23.36.252.26

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Server: 23.36.252.26 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:29 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 45
X-MNET-HL2: E
Expires: Thu, 24 Nov 2022 07:06:29 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame AC84
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y38X8pRI9r-idChmUeZLuQAAErcAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y38X8pRI9r-idChmUeZLuQAAErcAAAIB&dcc=t

43 B
855 B

359ms
358ms

Image
image/gif

209.54.182.161

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y38X8pRI9r-idChmUeZLuQAAErcAAAIB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Server

209.54.182.161 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:29 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: PMHFHT8V88QH76P8KWEZ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: DGAPRR5H7C01QQW7V73R
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y38X8pRI9r-idChmUeZLuQAAErcAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame AC84
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&expiration=1671865587&gdpr=0&gdpr_consent=

43 B
894 B

352ms
351ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&expiration=1671865587&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&expiration=1671865587&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame AC84
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y38X8pRI9r-idChmUeZLuQAAErcAAAIB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPHuRPL8GKmzmjDFjbNV6A8&google_cver=1

43 B
843 B

262ms
262ms

Image
image/gif

172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPHuRPL8GKmzmjDFjbNV6A8&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H3
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lp2GQslJNSFuZLTABDqSNcqfeuR8KE1xuAvD4iC%2F5kB5X47HGCns1up4ZLw3P7%2B9dKB1XmU0jOrPWwaUoNRm5ovZvyJPvGE%2BDZId9cC2AR1%2B6CphYY1eLfFaAB6Tyd08cd4cGl03KiVxNw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 76f04d56996a1c4e-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPHuRPL8GKmzmjDFjbNV6A8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame AC84
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2876532182884188220

43 B
894 B

514ms
351ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2876532182884188220
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
AN-X-Request-Uuid: ce575edd-d6e8-4468-b0b1-c13233d23c7a
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2876532182884188220
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame AC84
Redirect Chain

https://ad.turn.com/r/cs?pid=21
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=7344326985183242848

43 B
766 B

338ms
337ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=7344326985183242848
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=7344326985183242848
pragma: no-cache
date: Thu, 24 Nov 2022 07:06:27 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET

/
b1sync.zemanta.com/usersync/bluekai/callback/ Frame AC84
Redirect Chain

https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=
https://stags.bluekai.com/site/23178?id=G1jKn2iRNBZ8ELSCPPF3&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3S...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3SOVWT6Y3NL5SHG4C7NFSD2MJXEZSXQY3IMFXGOZJ5NFXGIZLYEZSXQ5DFOJXGC3C7OVZWK4S7NFSD2RZRNJFW4...

0
0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame AC84
Redirect Chain

https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1
https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&prevuid=03030001_637f17ef58b14&knw=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=03030001_637f17ef58b14

43 B
766 B

352ms
351ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=03030001_637f17ef58b14
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:29 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

date: Thu, 24 Nov 2022 07:06:28 GMT
server: nginx
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
access-control-allow-origin: *
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=03030001_637f17ef58b14
content-type: text/html; charset=UTF-8
cache-control: no-cache
keep-alive: timeout=10
access-control-allow-headers: Origin

GET
H2

200

crum
dsum.casalemedia.com/ Frame AC84
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e
https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=36b9be70-b143-f135-0bedd9e2

43 B
871 B

651ms
402ms

Image
image/gif

172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=36b9be70-b143-f135-0bedd9e2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:29 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H8pNfEdkfetKZhSyg2N1rBAiKVHPw%2B6wCycHDLhtJd4bE6jvEsaXWGOgp3kUp8WjA9y5odzkRWlNC17M%2FjMMRxl8rEFFv5kPwnf45iLOUZZDWDVLZ9vqjwuh4Y4NXMET9Qip4Wzj"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 76f04d5a3ee91c5e-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Thu, 24 Nov 2022 07:06:28 GMT
via: 1.1 google
server: nginx/1.22.1
p3p: CP='This is not a P3P policy!'
access-control-allow-origin: *
location: https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=36b9be70-b143-f135-0bedd9e2
content-type: text/html; charset=utf-8
cache-control: max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 119

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame AC84 43 B
353 B 414ms
123ms Image
image/gif 104.18.36.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?Y38X8pRI9r.idChmUeZLuQAA%264791
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:28 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 67768
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 76f04d59db641c56-AKL
content-length: 43
expires: Fri, 25 Nov 2022 07:06:28 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame FA9B 0
0 274ms
273ms Image
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221110&jk=1162199652779195&bg=!gYKlgsbNAAbvMpMzzzI7ACkAdvg8WnU3N4RWr5a-T_DdmMNYqU4CsAYJ3wVAczAk9A8IFwnvbC0YWwIAAAB0UgAAAANoAQeZAq0B7FmbhfMiRU9sNygH4BvqeyiYVK8DUQnPbmmUOmy1BR1gPe5mpoV0o6c_agmAhK-LQaogoExAC8vFWRBHcaAGFp4fLjbPRIg2aoD82oKZfdljaNRi1c5F085CHfCtvOdL8A0pBOIPMrfYKLaglxpnUkxGnaV8ZyBj-wv5vtZuAXPukB8HFbBhnSUzSLYQu5xrWBurbPHdiV9h8WpdYBtRyW2XNfYpFdSRGMz2CwLFtwvAd2530Uc2K_x8W6Od8nAE9C9KJjcrd0ZrOokm46qTKsI2nTNuEcdkGYRVeM-6CX-MYock0ebAOjaER_pmmjm2BTVphRuDMGvXxxllHHDBXakVTtdV8BuweuJ27_HPujfa8eM-OZ5BbnrcYMOryfMsVw_wwa4icwu_LnAQIJm0KJca1eDv6LwbH6l-WEjfO0vwPFLy3W0l5dyOqjVIxwT32YuRXSQRrHRnAWBx-1GASoVmwU7qKuDc2oGm7ZoZNWiCZiA14CADXr5bKPW9D21aN42Br7it3oNrsPdoGzXvDVPvu8jva2FfpGFsLCJqXrqROmsRAHoYHJF0PqrC0d2ebvliJpMFKKl0yW_UydMn0DGikzxntFc5Aft-gPUEGnswR1hcZgHXf0tSJ04pu02YTKrNp0zDACgubHFBQu6GXzzth8hB20sddwVycL3eQoMvC8Qy9Dd-9QIGyHZCgfL3xk-_6e1vGCnFr16izwo2r83q8vYKeiUxl-ZYh8IS_N2G04jY7nK960UTW-f86WQwlaSHHalk5LLWSYaTe_Pv1m1LtuQ0xrMWqf0Vo4rqsLzyMTBAiIAtmGlo9no1cWIuXhFBS83gqrd3RyX42Is3mEWPDu7Pj9vUYuXVO-UseIATR4_9_ob3rcXEDf1JfLiPMHAgbkt20996gEai
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET

Gnua0jdcgUBd2PatMce_f8n5EUdSAgOZEtemQ7w0kco
pr-bh.ybp.yahoo.com/sync/rubicon/ Frame 2BDC
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/Gnua0jdcgUBd2PatMce_f8n5EUdSAgOZEtemQ7w0kco?csrc=

0
0

GET

pixel
cm.g.doubleclick.net/ Frame 2BDC
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZTVmOWNmNDZmNzk5M2RjZjhmYWIyMmE3NDUzNWFjODUyOGE5NjIzOQ

0
0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 2BDC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEI88aXta1REaZXdGRO3NDBw&google_cver=1

42 B
679 B

237ms
236ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEI88aXta1REaZXdGRO3NDBw&google_cver=1
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: d335433bbbe0efeac67146df47932f6f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEI88aXta1REaZXdGRO3NDBw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

pixel
cm.g.doubleclick.net/ Frame 2BDC
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFVUUUzWFotMVMtTEJVMQ==

0
0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 2BDC
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&gdpr=0&gdpr_consent=&expires=30

42 B
679 B

237ms
236ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 550b0c1400f70e56269f7c1848fb3166
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET dcm
aax-eu.amazon-adsystem.com/s/ Frame 2BDC 0
0

GET

token
pixel.rubiconproject.com/ Frame 2BDC
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=EyU8VFnpTNeU8dV9UNISfA&rk=usync-na

0
0

GET

setuid
px.ads.linkedin.com/ Frame 2BDC
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LAUQE3XZ-1S-LBU1

0
0

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame DF16 5 KB
2 KB 929ms
244ms Document
text/html 35.74.137.60

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.74.137.60 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: a06ba300c8bc8c0864ce6683870b47a58786498e41d2f071f024a0132c337d25

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 24 Nov 2022 07:06:28 GMT
etag: W/"04d146ab191933401d801186fa2918acd"
server: nginx
timing-allow-origin: *

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 9092 4 KB
2 KB 552ms
552ms Document
text/html 51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

8fd4e8131d325c1be54cf2a6179c049e7ebb2bb48d7f6cc11930d5d70b0fa674

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1298
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 6566 1 KB
1 KB 948ms
268ms Document
text/html 23.106.127.52

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.106.127.52 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 653bb3f13e2828bbcf531edc5df349b1f76250ace2ca276da64aba632af8a7c8

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-length: 1112
content-type: text/html
date: Thu, 24 Nov 2022 07:06:28 GMT

GET
H3 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 9FA2 2 KB
1 KB 389ms
269ms Document
text/html 172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85e927caa69437c8ad21c6b96dbff9ae68d3827c75859acdf06bac864786877d

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 76f04d5659101c4e-AKL
content-encoding: br
content-type: text/html
date: Thu, 24 Nov 2022 07:06:28 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T7z2MNGbU2muOfPXAnfzBDBqN3yxpqhD0AntxQafr0DTMsaLptz4N5fQdcKf9S2wIxVLf2g76daIwJC72jZOD2i7aFI0lZxgpqEUvR7yPhN0Z51AqvvMkI9aYm67DAHer1yPYtWqobnTSg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 6DE3
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

281 B
554 B

247ms
246ms

Document
text/html

23.58.244.87
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.58.244.87 Cyberjaya, Malaysia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-58-244-87.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 24 Nov 2022 07:06:28 GMT
ETag: "40010-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 24 Nov 2022 07:06:28 GMT
location: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9632 15 KB
6 KB 555ms
241ms Document
text/html 23.72.44.196

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.72.44.196 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=78587
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Thu, 24 Nov 2022 07:06:28 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 25 Nov 2022 04:56:15 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync-iframe Show response
cs-rtb.minutemedia-prebid.com/ Frame 0C76 5 KB
5 KB 1134ms
461ms Document
text/html 13.33.88.40

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.88.40 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7df235164edd9fa37b11c7b5fccdafba1cb10ab745845e2e26fd5aee9c11bc21

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-type: text/html
date: Thu, 24 Nov 2022 07:06:28 GMT
via: 1.1 9f6f7c775068d68476f4af0ffa848d4a.cloudfront.net (CloudFront)
x-amz-cf-id: fxgeOamkjMc_8z4HZj0Z1LgVYSlYMmdGdpBLw3eVvnfH0J_1FZfFgA==
x-amz-cf-pop: SIN2-P2
x-cache: Miss from cloudfront

GET
H2

200

sync
ads.servenobid.com/ Frame 9D0B
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=2876532182884188220

0
344 B

408ms
408ms

Image
image/avif

52.16.204.248
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=2876532182884188220
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.16.204.248 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-204-248.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:28 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
AN-X-Request-Uuid: 758bd2c5-de7f-4736-97d3-80795c3334ef
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://ads.servenobid.com/sync?pid=312&uid=2876532182884188220
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET

sync
ads.servenobid.com/ Frame 9D0B
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=FtBqDLZHAgCKNBd7TTefKEVw

0
0

GET

sync
ads.servenobid.com/ Frame 9D0B
Redirect Chain

https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID&sovrn_retry=true
https://ads.servenobid.com/sync?pid=310&uid=FtBqDLZHAgCKNBd7TTefKEVw

0
0

GET

sync
ads.servenobid.com/ Frame 9D0B
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6973499488
https://sync.1rx.io/usersync/tradedesk/f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa
https://sync.targeting.unrulymedia.com/csync/RX-f256db65-b2d3-4798-ae52-901f8291d64a-004?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-f256db65-b2d3-4798-ae52-901f8291d64a-004
https://ads.servenobid.com/sync?pid=321&uid=RX-f256db65-b2d3-4798-ae52-901f8291d64a-004

0
0

GET cm
p.rfihub.com/ Frame 9D0B 0
0

GET usa
sync.go.sonobi.com/ Frame 9D0B 0
0

GET
H/1.1

204
No Content

pixel
ap.lijit.com/ Frame 9D0B
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ap.lijit.com/pixel?gdpr=1&gdpr_consent=&us_privacy=1YN-&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F9465%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3D4fd4250c-7c2e-4865-8db...

0
277 B

857ms
339ms

Image
text/plain

209.191.163.209

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?gdpr=1&gdpr_consent=&us_privacy=1YN-&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F9465%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3D4fd4250c-7c2e-4865-8dbd-5096ebceb1bd%26bidder%3Dsovrn%26cbx%3DaHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%253D%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Server: 209.191.163.209 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 24 Nov 2022 07:06:29 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3sfo1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

Redirect headers

location: https://ap.lijit.com/pixel?gdpr=1&gdpr_consent=&us_privacy=1YN-&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F9465%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3D4fd4250c-7c2e-4865-8dbd-5096ebceb1bd%26bidder%3Dsovrn%26cbx%3DaHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%253D%26uid%3D%24UID
date: Thu, 24 Nov 2022 07:06:27 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 9D0B
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ads.servenobid.com/sync?pid=337&uid=y-Irh0IUFE2uHKDKD.BtgE30kW217LSRETAbebB_s-~A

0
366 B

410ms
410ms

Image
image/avif

52.16.204.248
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-Irh0IUFE2uHKDKD.BtgE30kW217LSRETAbebB_s-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.16.204.248 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-204-248.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:28 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-Irh0IUFE2uHKDKD.BtgE30kW217LSRETAbebB_s-~A
date: Thu, 24 Nov 2022 07:06:28 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET redirectuser
ssp.disqus.com/ Frame 9D0B 0
0

GET

sync
ads.servenobid.com/ Frame 9D0B
Redirect Chain

https://ups.analytics.yahoo.com/ups/58632/occ
https://ads.servenobid.com/sync?pid=339&uid=y-Irh0IUFE2uHKDKD.BtgE30kW217LSRETAbebB_s-~A

0
0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame B82B 0
0 273ms
272ms Image
text/html 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221110&jk=3272243664975390&bg=!KCulK2_NAAbvMpMzzzI7ACkAdvg8Wp8kJH0e7onv_04kvuNw7FRpOxA-1PS9reFn5_ySH2Ey3iZ5_gIAAABSUgAAAANoAQeZArrjXutXz9-aW-oH8pUREGpZGoD3tLs3lktarh-FZaslGpkrvjsngy6b7pz8t3Dwehc4TpY68eSJAYlu6l-fWsjfC9y83QvpMzdk4wuhuYWobAYqTrQNjHXUlTBHXZzEy8FSQjldtCnuolVC-abIjzuS-cYVxICyIyqPnJuNUroL5BHGEc4qy-mij9VADQLT0C1kBETfPWzYBXM3i5y2NxlbY1JvT4vxLrvFOjegZFdyKiFkvVyEUnbkUsnOdIKhWxnJ-0og_F7rdRmGfdFQdks7iFqdUcYwmSjha4Oo_wtOsvOr3zGxcz_Lxkoj3Vbtt_mmcbOd86wJlsc1FccWWVwaJNk4_tYaPZWPFYLc9pq6dr4svkWNC_tC5QlveHDvKmYVKu_t_sj0u4LwrET5t452BDjqcnuWNHrQAEsRguEM6-b0Ax7_ym6HeAOCXOG-BY-5fGq4ahhXvMj2MnHXqZl2PauPBdpPwBKNenGIfWd5Gru5RWJXZYr5XtGN1z8_jM4NoDRCbDmvQLwxdDU-lPekw_G4OgjVH_2VAQXqfL31xEW_lx93ERjp0ntodVA0OfGRbRQe34ZDbtIYNJAjXES5DG61DcUU0hZieaMIM7IxWtVpvKge3mYXsj_xpj9K0Se835BcE9cKaHCerXmXTnKG2ccZrYnvsNQS3_7ARmOWVB2cgcgYOaXJHblYN86hAcUu60vp2tAmLqQprU6V67N6jNLgd9-gnHp5bfp82xU7yCbUhZAq3KSygh1TMMulq8d96gxLH3xQ0fVALnIF-_RKqypa66d-IGnZuHPokz6bMKSDJtfcXcW1OUh9mQWjkHB3dFjcX3KTP-WtXLuGfF6Xq1W1eBwWd_vrSijIVJdy1N7c1eCZEHrWD2OwGQAXt-PuTZc3IBNsnVttfN9SwR5qi-gl4Ezb4lcwkQ
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/chen-shi-zhong-xu-zuo-zi-ji-ling-hun-zhu-ren-jiang-mo-an-xiang-xin-zui-zhong-guang-ming-ke-yi-zhan-sheng-hei-an.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 239A 0
743 B 334ms
334ms Script
text/html 68.67.179.155
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.155 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
AN-X-Request-Uuid: 178970bc-fa8b-46a4-857e-348cb1feda05
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C3D4 42 B
64 B 291ms
290ms Fetch
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuuIL_Jmu7fEuzGRAWv4eaueeCHdgZFeX87MjXOnoKE1e3x8Vtt1oMt6L09s1gtn73G-OniEdP1Gso-wMzE44At0LyooyAk4ujGaDo4f6wsi4DNTVjUw5FZrfJMxkwUIlN5dPs&sai=AMfl-YQvoWrR7mGhDv036-m0WRVi3MRpiJ37vbkpdYaH7EvFDMV47ut-Xg8i0GTeaWtK_eYsO4cP4ppqtno3o_Dm4HAGMvmisprMLLrfMIeqcZ7QXr1CSeWYYHiG7PfyKAM&sig=Cg0ArKJSzL4sCw0nFgEdEAE&cid=CAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM&id=lidar2&mcvt=1000&p=1110,436,1200,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2857874404&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669273584650&rpt=2747&isd=0&lsd=0&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3EB8 0
20 B 272ms
271ms Ping
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9963024152063&version=m202209210101&ct=76&x=1&cor=12381268080485554000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3EB8 42 B
64 B 290ms
289ms Fetch
image/gif 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssjRnotp40zuv4-8qHr5mUd1R0Vai_vkcR9Zv0fLX9ZZ65gWfDkHNGkGX38HF9ES6pAFl-qjzIZOi9OjCo2bB3nv6Ys0yicGFiz5qnV4zGF26waIhlDNVXUx6GQRz7mDknNbD4&sai=AMfl-YSfEJXB1oH3FmXDlYwIPh4QP3czyQI-xkpp24Xd8kUISuKoKyqYcET7HNrIAuhFP5vnxEUW6dO2JWDRU1d5q4vSpQ-0C0zW4zZXcr44m8pNaDW0l_vBsu0ReIpdU8s&sig=Cg0ArKJSzGkr1twPna08EAE&cid=CAQSPADq26N9cytI0HTc1ZFPBd4topRsMduYFM_6MkfNBJhQNDf-q2FPnC8MLTCWE-8YuvCEisgzhVFJlOkVzxgBIBM&id=lidar2&mcvt=1011&p=300,5,900,125&mtos=1011,1011,1011,1011,1011&tos=1011,0,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4082231052&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669273584654&rpt=2928&isd=0&lsd=0&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-142-1-26.ap-southeast-1.compute.amazonaws.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://1892cd54c9ca834592bcdeb35ded3b25.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Nov 2022 07:06:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Y38X8pRI9r-idChmUeZLuQAAErcAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 9FA2 43 B
602 B 242ms
241ms Image
image/gif 18.142.1.26
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y38X8pRI9r-idChmUeZLuQAAErcAAAIB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.142.1.26 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:28 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

Y38X8pRI9r-idChmUeZLuQAAErcAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 9FA2
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Y38X8pRI9r-idChmUeZLuQAAErcAAAIB&gdpr_consent=&us_privacy=&gdpr=
https://pr-bh.ybp.yahoo.com/sync/casale/Y38X8pRI9r-idChmUeZLuQAAErcAAAIB

43 B
602 B

241ms
241ms

Image
image/gif

18.142.1.26
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y38X8pRI9r-idChmUeZLuQAAErcAAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

Server

18.142.1.26 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-142-1-26.ap-southeast-1.compute.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/Y38X8pRI9r-idChmUeZLuQAAErcAAAIB
date: Thu, 24 Nov 2022 07:06:28 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 9FA2
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=65ec637f-17f4-4200-8019-85b0f05d6157

43 B
766 B

338ms
337ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=65ec637f-17f4-4200-8019-85b0f05d6157
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:29 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

Date: Thu, 24 Nov 2022 07:06:28 GMT
Server: MT3 169 32252b7 master hkg-pixel-x24 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=65ec637f-17f4-4200-8019-85b0f05d6157
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 24 Nov 2022 07:06:27 GMT

GET ie
match.prod.bidr.io/cookie-sync/ Frame 9FA2 0
0

GET pm_match
um.simpli.fi/ Frame 9FA2 0
0

GET

usermatchredir
ssum-sec.casalemedia.com/ Frame 9FA2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y38X8pRI9r-idChmUeZLuQAAErcAAAIB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPHuRPL8GKmzmjDFjbNV6A8&google_cver=1

0
0

GET ZMAwryCI
sync-tm.everesttech.net/upi/pid/ Frame 9FA2 0
0

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 9FA2 43 B
855 B 345ms
344ms Image
image/gif 209.54.182.161

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y38X8pRI9r-idChmUeZLuQAAErcAAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Nov 2022 07:06:28 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: QF583PPDHFKZKG26PNZC
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 sync
ads.servenobid.com/ Frame 9FA2 0
356 B 409ms
408ms Image
image/avif 52.16.204.248
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=Y38X8pRI9r-idChmUeZLuQAAErcAAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.16.204.248 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-204-248.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:29 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H3 200 711916.gif
id.rlcdn.com/ Frame 9092 42 B
60 B 319ms
319ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/711916.gif?ct=4&cv=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 07:06:28 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET

/
onetag-sys.com/match/ Frame 9092
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D0%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=65ec637f-17f4-4200-8019-85b0f05d6157&gdpr=0&gdpr_consent=

0
0

GET

/
onetag-sys.com/match/ Frame 9092
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=2&uid=LAUQE3XZ-1S-LBU1&gdpr=0

0
0

GET

/
onetag-sys.com/match/ Frame 9092
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D0%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=2876532182884188220

0
0

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame 9092 42 B
679 B 240ms
238ms Image
image/gif 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=984pnNtmNI4N4XHXKGw99d0FiLjDmMQC33n3BE65WXo
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: f60a7260b0ebb7a40a81234af4a9e826
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame 9092
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=1YN-&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
https://onetag-sys.com/match/?int_id=107&uid=3032712610375068304

0
291 B

394ms
392ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=107&uid=3032712610375068304

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=107&uid=3032712610375068304
date: Thu, 24 Nov 2022 07:06:28 GMT
content-length: 0

GET

pixel
cm.g.doubleclick.net/ Frame 9092
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=1YN-&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID
https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=1YN-&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID&rdf=1
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NTQ1NkQ3MjEtNDZDNy00QjYyLTkxOUMtMzcwREUzODM2NURF&gdpr=0&gdpr_consent=

0
0

GET

/
onetag-sys.com/match/ Frame 9092
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESELwip3yPgokJPUvSJ84Cjdo&google_cver=1

0
0

GET

/
onetag-sys.com/match/ Frame 9092
Redirect Chain

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=92&uid=y-Irh0IUFE2uHKDKD.BtgE30kW217LSRETAbebB_s-~A

0
0

GET

/
onetag-sys.com/match/ Frame 9092
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa&gdpr=0&gdpr_consent=

0
0

GET sync
x.bidswitch.net/ Frame 9092 0
0

GET sync
ads.servenobid.com/ Frame 9092 0
0

GET PugMaster
image6.pubmatic.com/AdServer/ Frame 9632 0
0

GET usync.js
eus.rubiconproject.com/ Frame 6DE3 0
0

GET

usersync
usersync.gumgum.com/ Frame DF16
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=2876532182884188220

0
0

GET

sync
odr.mookie1.com/t/v2/ Frame DF16
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=a_c04be167-a066-4932-8b9d-a468fb70a30a&gdpr=0&gdpr_consent=&us_privacy=1---
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=aa83cb34-48e2-4a27-8473-dc326e7ece18&ssp=gumgum2&gdpr=0&gdpr_consent=

0
0

GET sync
sync.srv.stackadapt.com/ Frame DF16 0
0

GET

23178
stags.bluekai.com/site/ Frame DF16
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=a_c04be167-a066-4932-8b9d-a468fb70a30a&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=G1jKn2iRNBZ8ELSCPPF3&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...

0
0

GET

sync
x.bidswitch.net/ Frame DF16
Redirect Chain

https://sync.1rx.io/usersync2/floor6?gdpr=0&gdpr_consent=&dspret=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D
https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-f256db65-b2d3-4798-ae52-901f8291d64a-004&rndcb=8773140094

0
0

GET rtset
bh.contextweb.com/bh/ Frame DF16 0
0

GET redirectObuid
sync.outbrain.com/ Frame DF16 0
0

GET

usersync
usersync.gumgum.com/ Frame DF16
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=653f5fbc-dbf7-46c6-90c7-68834a15e1a1

0
0

GET gumgum
pr-bh.ybp.yahoo.com/sync/ Frame DF16 0
0

GET generic
sync.ipredictive.com/d/sync/cookie/ Frame DF16 0
0

GET services
sync.technoratimedia.com/ Frame DF16 0
0

GET 142
match.deepintent.com/usersync/ Frame DF16 0
0

GET server_match
ad.360yield.com/ Frame DF16 0
0

GET sync
ssbsync.smartadserver.com/api/ Frame DF16 0
0

GET sync
ads.servenobid.com/ Frame DF16 0
0

GET sync
ads.servenobid.com/ Frame 6566 0
0

GET bsync
visitor.omnitagjs.com/visitor/ Frame 6566 0
0

GET

/
rtb-csync.smartadserver.com/redir/ Frame 6566
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=39&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D25%26partneruserid%3D%5BMM_UUID%5D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=65ec637f-17f4-4200-8019-85b0f05d6157&gdpr=0&gdpr_consent=

0
0

GET /
rtb-csync.smartadserver.com/redir/ Frame 6566 0
0

GET oRTB
sync.inmobi.com/ Frame 6156 0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame B774 15 KB
6 KB 257ms
242ms Document
text/html 23.72.44.196

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.72.44.196 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=78586
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Thu, 24 Nov 2022 07:06:29 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 25 Nov 2022 04:56:15 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET

usersync
usersync.gumgum.com/ Frame 252D
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=f5e508fb-dd33-4a65-bf3c-c1fe3637c0aa

0
0

GET

usersync
usersync.gumgum.com/ Frame CD3E
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=65ec637f-17f4-4200-8019-85b0f05d6157&gdpr=0&gdpr_consent=

0
0

GET URnmbSKM
sync-tm.everesttech.net/upi/pid/ Frame 1782 0
0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 72D7 170 B
188 B 285ms
274ms Document
image/png 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=YV9jMDRiZTE2Ny1hMDY2LTQ5MzItOGI5ZC1hNDY4ZmI3MGEzMGE=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS