fontesk.com Open in urlscan Pro
209.16.158.135 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://fontesk.com/
Effective URL:
https://fontesk.com/
Submission: On October 15 via api (October 15th 2023, 10:37:53 pm UTC) from US — Scanned from CA

Summary HTTP 216 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 24 IPs in 3 countries across 17 domains to perform 216 HTTP transactions. The main IP is 209.16.158.135, located in Canada and belongs to PLANETHOSTER-8, CA. The main domain is fontesk.com.
TLS certificate: Issued by R3 on October 13th 2023. Valid for: 3 months.

This is the only time fontesk.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 35	209.16.158.135 209.16.158.135	53589 (PLANETHOS...) (PLANETHOSTER-8)
1	172.253.63.97 172.253.63.97	15169 (GOOGLE) (GOOGLE)
1	172.253.63.95 172.253.63.95	15169 (GOOGLE) (GOOGLE)
51	142.251.111.154 142.251.111.154	15169 (GOOGLE) (GOOGLE)
9	142.251.163.94 142.251.163.94	15169 (GOOGLE) (GOOGLE)
1	216.239.34.181 216.239.34.181	15169 (GOOGLE) (GOOGLE)
7	172.253.63.155 172.253.63.155	15169 (GOOGLE) (GOOGLE)
1 18	142.251.16.156 142.251.16.156	15169 (GOOGLE) (GOOGLE)
24	142.251.163.132 142.251.163.132	15169 (GOOGLE) (GOOGLE)
11 16	142.251.163.155 142.251.163.155	15169 (GOOGLE) (GOOGLE)
7 13	104.18.27.193 104.18.27.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5 8	68.67.179.155 68.67.179.155	29990 (ASN-APPNEX) (ASN-APPNEX)
6	142.251.167.155 142.251.167.155	15169 (GOOGLE) (GOOGLE)
17	172.253.115.148 172.253.115.148	15169 (GOOGLE) (GOOGLE)
14	172.253.115.101 172.253.115.101	15169 (GOOGLE) (GOOGLE)
3	34.107.189.102 34.107.189.102	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 4	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	104.112.20.199 104.112.20.199	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	142.251.163.99 142.251.163.99	15169 (GOOGLE) (GOOGLE)
1	23.44.208.234 23.44.208.234	16625 (AKAMAI-AS) (AKAMAI-AS)
10	104.76.104.56 104.76.104.56	16625 (AKAMAI-AS) (AKAMAI-AS)
1	54.192.51.80 54.192.51.80	16509 (AMAZON-02) (AMAZON-02)
2	172.253.122.155 172.253.122.155	15169 (GOOGLE) (GOOGLE)
216	24

35 209.16.158.135 (Canada) 1 redirects

ASN53589 (PLANETHOSTER-8, CA)
PTR: hybrid4002.ca.ns.planethoster.net

fontesk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.63.97 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.63.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

51 142.251.111.154 (United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f154.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.251.163.94 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.34.181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.253.63.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 142.251.16.156 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bl-in-f156.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 142.251.163.132 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f132.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 142.251.163.155 (United States) 11 redirects

ASN15169 (GOOGLE, US)
PTR: wv-in-f155.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 104.18.27.193 (None, ) 7 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 68.67.179.155 (North Bergen, United States) 5 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.251.167.155 (United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f155.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 172.253.115.148 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f148.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 172.253.115.101 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f101.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.107.189.102 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 102.189.107.34.bc.googleusercontent.com

ctxtfl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.98.64.218 (Kansas City, United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.112.20.199 (Ashburn, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-112-20-199.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.163.99 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: wv-in-f99.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.44.208.234 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-44-208-234.deploy.static.akamaitechnologies.com

servedby.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.76.104.56 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-76-104-56.deploy.static.akamaitechnologies.com

cdn.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.192.51.80 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-51-80.yul62.r.cloudfront.net

adstudio-asset-lib.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.122.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f155.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
75	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 108 tpc.googlesyndication.com — Cisco Umbrella Rank: 157	717 KB
41	doubleclick.net 12 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 98 googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 cm.g.doubleclick.net — Cisco Umbrella Rank: 255 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 443	225 KB
35	fontesk.com 1 redirects fontesk.com	2 MB
17	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 344	279 KB
17	google.com 1 redirects analytics.google.com — Cisco Umbrella Rank: 178 fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1474 www.google.com — Cisco Umbrella Rank: 2	64 KB
13	casalemedia.com 7 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 716	9 KB
12	flashtalking.com servedby.flashtalking.com — Cisco Umbrella Rank: 1143 cdn.flashtalking.com — Cisco Umbrella Rank: 1384 adstudio-asset-lib.flashtalking.com — Cisco Umbrella Rank: 38960	214 KB
8	adnxs.com 5 redirects ib.adnxs.com — Cisco Umbrella Rank: 261	6 KB
8	gstatic.com fonts.gstatic.com p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com	129 KB
5	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 223	294 KB
4	openx.net 3 redirects us-u.openx.net — Cisco Umbrella Rank: 547	1 KB
3	ctxtfl.com ctxtfl.com — Cisco Umbrella Rank: 23426	8 KB
3	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1200 www.googleadservices.com — Cisco Umbrella Rank: 153	533 B
2	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 1584	628 B
1	google.ca www.google.ca — Cisco Umbrella Rank: 9740	408 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 49	1022 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 56	85 KB
216	17

	Domain	Requested by
51	pagead2.googlesyndication.com	fontesk.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
35	fontesk.com	1 redirects fontesk.com
24	tpc.googlesyndication.com	googleads.g.doubleclick.net fontesk.com tpc.googlesyndication.com pagead2.googlesyndication.com
18	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net fontesk.com
17	s0.2mdn.net	googleads.g.doubleclick.net fontesk.com s0.2mdn.net
16	cm.g.doubleclick.net	11 redirects googleads.g.doubleclick.net
14	fundingchoicesmessages.google.com	pagead2.googlesyndication.com
13	dsum-sec.casalemedia.com	7 redirects googleads.g.doubleclick.net
10	cdn.flashtalking.com	servedby.flashtalking.com cdn.flashtalking.com adstudio-asset-lib.flashtalking.com
8	ib.adnxs.com	5 redirects googleads.g.doubleclick.net
6	googleads4.g.doubleclick.net	googleads.g.doubleclick.net fontesk.com
6	fonts.gstatic.com	fonts.googleapis.com
5	www.googletagservices.com	googleads.g.doubleclick.net fontesk.com
4	us-u.openx.net	3 redirects googleads.g.doubleclick.net
3	ctxtfl.com	s0.2mdn.net ctxtfl.com
2	www.googleadservices.com
2	www.google.com	1 redirects tpc.googlesyndication.com
2	sync.teads.tv	1 redirects googleads.g.doubleclick.net
2	p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com	googleads.g.doubleclick.net p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com
1	adstudio-asset-lib.flashtalking.com	cdn.flashtalking.com
1	servedby.flashtalking.com	googleads.g.doubleclick.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.google.ca	fontesk.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	fonts.googleapis.com	fontesk.com
1	www.googletagmanager.com	fontesk.com
216	27

This site contains links to these domains. Also see Links.

Domain
1.envato.market
www.pinterest.com
www.behance.net
www.instagram.com
ko-fi.com

Subject Issuer	Validity	Valid
*.fontesk.com R3	`2023-10-13` - `2024-01-11`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
ctxtfl.com GTS CA 1D4	`2023-09-11` - `2023-12-10`	3 months	crt.sh
servedby.flashtalking.com DigiCert TLS RSA SHA256 2020 CA1	`2023-09-14` - `2024-09-14`	a year	crt.sh
cdn.flashtalking.com DigiCert TLS RSA SHA256 2020 CA1	`2023-05-04` - `2024-05-03`	a year	crt.sh
*.flashtalking.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-21` - `2024-03-23`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh

This page contains 27 frames:

Primary Page: https://fontesk.com/
Frame ID: 6F323B0DDF3BE3746A37C1DEEC516211
Requests: 70 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231011/r20190131/zrt_lookup.html
Frame ID: 064366211B65B7A0495A25261EECDE5C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&adk=1812271804&adf=3025194257&lmt=1697434669&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Ffontesk.com%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468749&bpp=6&bdt=367&idt=222&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5245609155967&frm=20&pv=2&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=275
Frame ID: BABD975C3B0CE77C076C348CFC37498C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=9027243322&adk=525839248&adf=309123476&pi=t.ma~as.9027243322&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468755&bpp=2&bdt=373&idt=274&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEe%7C&abl=CS&pfx=0&cms=2&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=g01fZs71po&p=https%3A//fontesk.com&dtd=281
Frame ID: 7990160849406699EE8A5D7A0DF54835
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=1389527199&adk=3956400729&adf=2752187097&pi=t.ma~as.1389527199&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468757&bpp=1&bdt=375&idt=294&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=799&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CovEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=r7Kdp7j61o&p=https%3A//fontesk.com&dtd=305
Frame ID: AFFDBF653ABF6C5D9B58C6BCB14E26A1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=8732050345&adk=1761106037&adf=2584966758&pi=t.ma~as.8732050345&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468758&bpp=1&bdt=376&idt=314&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x90%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2667&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CovEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=hGnVLPzdXz&p=https%3A//fontesk.com&dtd=317
Frame ID: FE032BB89510CE08451430DB630876AD
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=9786891966&adk=1700949682&adf=1429666621&pi=t.ma~as.9786891966&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&alternate_ad_url=https%3A%2F%2Ffontesk.com%2Ffooter.html&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468758&bpp=1&bdt=376&idt=324&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df28d7aae89707d1a-225947c997e400df%3AT%3D1697409468%3ART%3D1697409468%3AS%3DALNI_MaItdktrxAmdX4SzTAd22-7GRXDIg&gpic=UID%3D00000d99eab73a39%3AT%3D1697409469%3ART%3D1697409469%3AS%3DALNI_Mbeki3Ru-7d-U3dT_JYZZMtqFRvIA&prev_fmts=0x0%2C1200x90%2C1200x90%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3421&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=KzRDuky3LM&p=https%3A//fontesk.com&dtd=328
Frame ID: 00D3B34F5051D7BA055CD53E3FA8177A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpL6JAhidiuHtATAB&v=APEucNUARvtsTHq6F1IO5JuF3jrD5cTyZhDMsDjJOe372w3g_hT3nocPoVSHwbJl30dAMXvwFXHvuVVZWSKmiH0T3eY2rA6Lug
Frame ID: 4ADA648AF0BF113AE68EB2EC099C3917
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: 51052DB1C90597AB7EE0DCD21C460153
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpL6JAhidiuHtATAB&v=APEucNWuqp_7CPtNfQWzd4a_wepXw2mu_cFzJ1le5bk8GEHkrEgBmtcn6yHkF_J4RJH4Vx254ogV71MaoHwIvD4IXjaEKsmu1g
Frame ID: 593F911130BDF719292C390FE4B4AC5B
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: 5944198B41922F9D923A27E60624BF10
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL-7v_oDEIC9jf0DGM7N0vkBMAE&v=APEucNXDNRRQ6WbHK_lh7SSFnpJTW6_-b250_6R1j7hgKie9ZfN61vaqw-cpJgkQVQPHztgiCowS6HWyGNle35fb6yU8A69-xg
Frame ID: 4321D6A99095589B603DD5CAC4358D25
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: 63FF2B2218DBE0879F99C41ACBE2C084
Requests: 20 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 21BA4AF8A30B9BF3A1188B5746A95FCA
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: B94CF56E3F7990D0F9949B3D72B88D5C
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: CD041A80D3A104E5B89489C8125C11D5
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
Frame ID: CA7177F4BC3B3627B8C5474D9B3F5BF0
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231011/r20110914/zrt_lookup.html?fsb=1
Frame ID: 373738CB32D2670BF7EA80F5792EADA5
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: CC2C9288E666DE3C2389456E7BA73D5E
Requests: 2 HTTP requests in this frame

Frame: https://p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Frame ID: B69D1C2159AD101C15CD5F0B2B1E3583
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPWzIBDJj_EBGN_RkuABMAE&v=APEucNW-hYGrfZfyKVSx9iUIkEa1q80xG5K79E-XDrGKx4uXUp031oJGUCQlB31QzSvvVKUr0CiOJg2erAEY7AefEaL2Smj6vA
Frame ID: 460F09E36C4407B180D52054A5E3C0C3
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: F4AEAB2C46AD758AF99DE6CF5A9E1E17
Requests: 16 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 8331A58E86A9F3CB4E26A93A4844FE1A
Requests: 3 HTTP requests in this frame

Frame: https://cdn.flashtalking.com/172384/4200646/main.html
Frame ID: 123E00A835F92C5EC299626CD3B664FC
Requests: 10 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js
Frame ID: 37DB7B3DA3DC4D0CE319AA7E561577B7
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 269AE01E31F4C8ECF7196FE099AEF006
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 4F43B5B50C29C15AC64405EE9501A8AC
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Free Fonts & Typefaces › Fontesk

Page URL History Show full URLs

http://fontesk.com/ HTTP 301
https://fontesk.com/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

Page Statistics

216
Requests

92 %
HTTPS

0 %
IPv6

17
Domains

27
Subdomains

24
IPs

3
Countries

3942 kB
Transfer

7481 kB
Size

17
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://1.envato.market/3e3k
Title: <img src="https://fontesk.com/wp-content/uploads/2023/10/0e398313-d44e-4a73-87c3-ee5617de3f32-2-min.jpg" alt="0e398313-d44e-4a73-87c3-ee5617de3f32 (2)-min" data-maxdpr="1.7" class="lazyload" /><meta itemprop="url" content="https://fontesk.com/wp-content/uploads/2023/10/0e398313-d44e-4a73-87c3-ee5617de3f32-2-min.jpg"><meta itemprop="width" content="580"><meta itemprop="height" content="326">

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/fonteskfonts/

Search URL Search Domain Scan URL

URL: https://www.behance.net/fontesk

Search URL Search Domain Scan URL

URL: https://www.instagram.com/fontesk.fonts/

Search URL Search Domain Scan URL

URL: https://ko-fi.com/fontesk

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://fontesk.com/ HTTP 301
https://fontesk.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 66

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ydf9S-BoboQ5Fs9kQVE4&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ydf9S-BoboQ5Fs9kQVE4&google_cver=1&C=1

Request Chain 67

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZSxpvQL.3eYgkGRQn9FFAwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1&google_hm=2

Request Chain 68

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFzzHHZkS6p0HleOle8q9ag&google_cver=1

Request Chain 69

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc0NTI4ODcwMTAyNTI1OTA3OQ%3D%3D

Request Chain 70

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1&C=1

Request Chain 71

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZSxpvRhNYXnbwXFZ7fDzWgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1

Request Chain 72

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEDfKLK3zqhtJ3FmnnZ2_xQU&google_cver=1

Request Chain 73

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTczNjYyNTE0NjI3ODMxNzgwMw%3D%3D

Request Chain 87

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1

Request Chain 88

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZSxpvZI3NnEuUUkVRqkpdQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1

Request Chain 89

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEDfKLK3zqhtJ3FmnnZ2_xQU&google_cver=1

Request Chain 90

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc0NTI4ODcwMTAyNTI1OTA3OQ%3D%3D

Request Chain 142

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEPsnzsYWcuIcdOq4KotJeo&google_cver=1 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEEPsnzsYWcuIcdOq4KotJeo&google_cver=1

Request Chain 143

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjBiYmRmYjYtYWQxZC0yYWI2LWM4OTEtMWEyMWRlNzNjMjFi

Request Chain 144

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEDNrMgzHgJUxLuenWtdo9DM&google_cver=1

Request Chain 145

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ODYzODNhMmYtMmFjMi00NmYxLWI4ZmItMzhhODE2YjVkODc4

Request Chain 164

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 180

https://googleads.g.doubleclick.net/pagead/adview?ai=ChZ2kvWksZaDgBMT3xtYPutmOSMGNnrVz2IrFm-0Q3eurr94BEAEg5ealb2D96KKB8AOgAfCttbcDyAECqAMByAPJBKoE1gFP0AghBen9mYsqpW1CFsn-_HAnwJCnGtFufmYLeNwFXBt6z3CR1HB5gKDBlBI4hoGlfRQyd8qQm4aNWunb8a6GS7KIrS35gDyMK2n0jaFTo-MtW9kXDMyfD130Ye9s4eUrzTu-wfZOQP6ZLMt2cgLLzYSfgsib_qDfAivnzw9ol_uVtMZdvFJmGXtwPa6l0GTM9lDiJ7_MndXZA89VYY5pHjmPKntMgHpdUz4f8yBQuf99XU-de1Pa8Jh8uxARrLu6StloItP67Eqnm1hJnRJZWpRbOyblwASay4Gw_QOIBbCYwcJEkgUECAQYAZIFBAgFGASgBgKAB_jRykioB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBClmD7SCBQIgGEQARgfMgKKAjoCgEBIvf3BOpoJImh0dHBzOi8vZWxlbWVudHMuZW52YXRvLmNvbS9mb250cy-ACgHICwHaDBEKCxCgl-Tjtb_D5qEBEgIBA9gTDdAVAYAXAbIXHAoaCAASFHB1Yi01OTUyMzA2OTQwMDMxMDk3GAA&sigh=pS1q2qzX7z0&uach_m=[UACH]&ase=2&nis=4&cid=CAQSTADICaaNYS6byc6dNX-XJKmtiF7Z1mxsv4QejT6LLrdk5ALTR5qXLbZIcZPlD12lA_ylHIfyWoMTuyr7OTWxfu9u1zXmGtwkwrYmh8YYAQ&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x13233caa5bf444b90000000000000000%22,%222%22:%220x7340d059dfc968e50000000000000000%22,%223%22:%220xe89f0832f88de9e0000000000000000%22,%224%22:%220xb6da75fa197e92f90000000000000000%22,%225%22:%220x76659f0feb84670e0000000000000000%22},%22debug_key%22:%2211564254067326906306%22,%22debug_reporting%22:true,%22destination%22:%22https://envato.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22921523952%22],%224%22:[%2210-15%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2210309910352839377713%22}&andc=true

216 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
fontesk.com/
Redirect Chain

http://fontesk.com/
https://fontesk.com/

131 KB
15 KB

176ms
135ms

Document
text/html

209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to

Full URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 80b0240a614b9c4e980265c79d67ec0a2e59448674d7d8324ee17af2b35118d9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=3600, must-revalidate max-age=0
content-encoding: gzip
content-length: 14870
content-type: text/html; charset=UTF-8
date: Sun, 15 Oct 2023 22:37:47 GMT
expires: Sun, 15 Oct 2023 22:37:47 GMT
hummingbird-cache: Served
server: Apache
vary: Accept-Encoding

Redirect headers

Cache-Control: max-age=0
Connection: Keep-Alive
Content-Length: 228
Content-Type: text/html; charset=iso-8859-1
Date: Sun, 15 Oct 2023 22:37:47 GMT
Expires: Sun, 15 Oct 2023 22:37:47 GMT
Keep-Alive: timeout=5, max=100
Location: https://fontesk.com/
Server: Apache

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 247 KB
85 KB 111ms
48ms Script
application/javascript 172.253.63.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-445N6DQJQ8

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

38a1c4bec530bf672936b3930579412f6e464808681f88c45a6db47f54e7362a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 86644
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 15 Oct 2023 22:37:48 GMT

GET
H2 200 c2a0403880aafa271152317c3ec50298.css
fontesk.com/wp-content/uploads/hummingbird-assets/ 178 KB
28 KB 46ms
45ms Stylesheet
text/css 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to

Full URL: https://fontesk.com/wp-content/uploads/hummingbird-assets/c2a0403880aafa271152317c3ec50298.css
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: df24d70954a21bd35ed6853799dc0505bfc110bcf417dc3af628e2c4dbd699c0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Fri, 13 Oct 2023 01:59:29 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 28767
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 css
fonts.googleapis.com/ 8 KB
1022 B 105ms
41ms Stylesheet
text/css 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Barlow%3A700%2C600%2C500%2C300%2Cregular%2C100%2C200&subset=latin-ext&ver=7edc83995d8ff3030fe1a7910eff6904

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f95.1e100.net

Software

ESF /

Resource Hash

914408bbcbb862bf8d2c7ea6a174f2d2db2cbd23609c79823bb26fa694a9bc0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 15 Oct 2023 22:37:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 15 Oct 2023 22:37:48 GMT

GET
H2 200 0c6761de42a9609acb9d56fd2d73a924.js Show response
fontesk.com/wp-content/uploads/hummingbird-assets/ 99 KB
34 KB 56ms
55ms Script
application/javascript 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to

Full URL: https://fontesk.com/wp-content/uploads/hummingbird-assets/0c6761de42a9609acb9d56fd2d73a924.js
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 5674b0a11a287377a390c9a6c3c2946b3304596cb4fd10a63f5203a3a85f8a31

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Fri, 13 Oct 2023 01:59:31 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 34434
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 flogo.png
fontesk.com/wp-content/uploads/2018/09/ 8 KB
8 KB 26ms
25ms Image
image/png 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2018/09/flogo.png
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 3ff684c4492a4c057f332f9791d4b66381b7d9c428c41b61b2b12aa2eb8d1ffe

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Mon, 24 Sep 2018 06:37:21 GMT
server: Apache
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 8460
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
51 KB 119ms
52ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5952306940031097

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

7b27c8df26a25938b5054d1dd3ff31601231bbfa6a9e600b2976db55ed4465ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
Origin: https://fontesk.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51319
x-xss-protection: 0
server: cafe
etag: 4924024872938862046
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:48 GMT

GET
H2 200 50472dcfaeeeb2e2f5a708dfae17ca9b.js Show response
fontesk.com/wp-content/uploads/hummingbird-assets/ 80 KB
25 KB 36ms
35ms Script
application/javascript 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to

Full URL: https://fontesk.com/wp-content/uploads/hummingbird-assets/50472dcfaeeeb2e2f5a708dfae17ca9b.js
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 6d95f4fdd5d8790fae4e9f0c01fb01461e5695dd458d29dcf331c7f6819fb2bf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Fri, 13 Oct 2023 01:59:43 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 25749
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 general.js Show response
fontesk.com/wp-content/themes/fontesk/js/ 35 KB
8 KB 32ms
32ms Script
application/javascript 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to

Full URL: https://fontesk.com/wp-content/themes/fontesk/js/general.js
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 6992d29f1d376a718139e05e9e96a8a0158e01c6f237c1036a34c03cdec64017

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Sun, 17 Apr 2022 08:34:31 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 8358
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 fd13326b6e3aebfdbedd973a7c15cf6f.js Show response
fontesk.com/wp-content/uploads/hummingbird-assets/ 35 KB
10 KB 24ms
23ms Script
application/javascript 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to

Full URL: https://fontesk.com/wp-content/uploads/hummingbird-assets/fd13326b6e3aebfdbedd973a7c15cf6f.js
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 70bbf6738099d0cad621f6d010c19eeb4d842fe77a9bb6902caf393e5a451324

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Fri, 13 Oct 2023 02:02:53 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 10049
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 603 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9590dff58da946472b892f7152dfd4999defba8934f2a2f472086253489e0a36

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 fontawesome-webfont.woff2
fontesk.com/wp-content/themes/fontesk/fonts/ 75 KB
75 KB 22ms
22ms Font
font/woff2 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to

Full URL: https://fontesk.com/wp-content/themes/fontesk/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: fontesk.com
URL: https://fontesk.com/wp-content/uploads/hummingbird-assets/c2a0403880aafa271152317c3ec50298.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://fontesk.com/wp-content/uploads/hummingbird-assets/c2a0403880aafa271152317c3ec50298.css
Origin: https://fontesk.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Wed, 08 Feb 2017 15:39:04 GMT
server: Apache
vary: Accept-Encoding
content-type: font/woff2
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 fntsksm.png
fontesk.com/wp-content/uploads/2018/09/ 3 KB
3 KB 21ms
20ms Image
image/png 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2018/09/fntsksm.png
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: c426be49b7aea3a132da3dbcac53585a3cf8deefc632874ebb94bac37d890f3d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Mon, 24 Sep 2018 06:38:33 GMT
server: Apache
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 2780
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 signature_fonts.jpg
fontesk.com/wp-content/uploads/2019/10/ 6 KB
6 KB 35ms
29ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2019/10/signature_fonts.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 7e4aed045d37bd4d19a509734ab12187cdc030a518ca933cda82032006914bd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Thu, 03 Oct 2019 04:45:38 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 5664
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 vintage_font.jpg
fontesk.com/wp-content/uploads/2019/10/ 6 KB
5 KB 37ms
31ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2019/10/vintage_font.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 307b097e4a0019e300a74e226a50b770fd20d56e2b6efafab8ee82a59db2f566

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Thu, 03 Oct 2019 04:45:39 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 5555
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 geometric.jpg
fontesk.com/wp-content/uploads/2020/04/ 8 KB
7 KB 35ms
29ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2020/04/geometric.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 22cf17f7e47177d0305a0cf4a254015a07db3b8ce9c92cbaf28bed815c39461a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Thu, 30 Apr 2020 13:41:37 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 7382
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 blackletter_fonts.jpg
fontesk.com/wp-content/uploads/2019/10/ 6 KB
5 KB 35ms
29ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2019/10/blackletter_fonts.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 6393ecabbf74e0536c0e3830bbc811623f5c03ecd333058d0aa826e0fc4c514b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Thu, 03 Oct 2019 04:45:40 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 5139
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 calligraphy_fonts.jpg
fontesk.com/wp-content/uploads/2019/10/ 7 KB
6 KB 36ms
31ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2019/10/calligraphy_fonts.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 262224e34eafa2556bc48f8a13a2734bc1336d77cc4325febaee595991e5b782

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Thu, 03 Oct 2019 04:45:39 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 6420
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 unique_fonts.jpg
fontesk.com/wp-content/uploads/2019/10/ 5 KB
4 KB 36ms
31ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2019/10/unique_fonts.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 77b1c57ff49aef85b5c11db08fb449b4f7b36b3cc833afd94b826d718b6ff1b4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Thu, 03 Oct 2019 04:45:38 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 4131
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 bomberg-1-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 51 KB
49 KB 36ms
32ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/bomberg-1-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 0f14858a72f4127384ce7c0ba1aa1eda2d4a8a8df92061ee4611a8f057f32b94

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Sat, 07 Oct 2023 07:28:20 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 50520
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 ar_one_sans-2-590x332.jpg
fontesk.com/wp-content/uploads/2023/09/ 71 KB
68 KB 45ms
41ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/09/ar_one_sans-2-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 93238057168c959a4d207b6581961ab01c778f7833aa7f1f0d85d452495d49b2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Mon, 18 Sep 2023 08:00:05 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 Copy-of-Christmas-in-July-Bundle-Preview-Images-1200x800px-1-min-590x332.jpg
fontesk.com/wp-content/uploads/2023/06/ 146 KB
145 KB 40ms
36ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/06/Copy-of-Christmas-in-July-Bundle-Preview-Images-1200x800px-1-min-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 6d16450a4b99217e47f194f24d4b2b6bec48cddc703482d9fde182f30a35bd5f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Wed, 21 Jun 2023 09:34:47 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 kusack_signature-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 19 KB
17 KB 42ms
38ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/kusack_signature-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 559ffef94e5dfe1a2f93d44609a27f2374364d115f3bb31b12443c2769e714ca

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Sat, 14 Oct 2023 09:22:18 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 16898
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 7cHpv4kjgoGqM7E_DMs5.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 127ms
58ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHpv4kjgoGqM7E_DMs5.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow%3A700%2C600%2C500%2C300%2Cregular%2C100%2C200&subset=latin-ext&ver=7edc83995d8ff3030fe1a7910eff6904

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://fontesk.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:28:21 GMT
x-content-type-options: nosniff
age: 274167
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21144
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:43:23 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:28:21 GMT

GET
H2 200 7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v12/ 20 KB
21 KB 99ms
32ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3_-gs51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow%3A700%2C600%2C500%2C300%2Cregular%2C100%2C200&subset=latin-ext&ver=7edc83995d8ff3030fe1a7910eff6904

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://fontesk.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:25:24 GMT
x-content-type-options: nosniff
age: 274344
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20960
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:18:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:25:24 GMT

GET
H2 200 7cHqv4kjgoGqM7E3t-4s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 115ms
50ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3t-4s51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow%3A700%2C600%2C500%2C300%2Cregular%2C100%2C200&subset=latin-ext&ver=7edc83995d8ff3030fe1a7910eff6904

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://fontesk.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:33:11 GMT
x-content-type-options: nosniff
age: 273877
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21724
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:29:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:33:11 GMT

GET
H2 200 7cHqv4kjgoGqM7E3p-ks51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 130ms
67ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3p-ks51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow%3A700%2C600%2C500%2C300%2Cregular%2C100%2C200&subset=latin-ext&ver=7edc83995d8ff3030fe1a7910eff6904

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

6563f08627fa2cd60c0c300318405b6f545f0d7f469df6ba87c9e31ecc987217

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://fontesk.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:10:24 GMT
x-content-type-options: nosniff
age: 275244
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20992
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:13:23 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:10:24 GMT

GET
H2 200 7cHqv4kjgoGqM7E30-8s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 136ms
72ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E30-8s51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow%3A700%2C600%2C500%2C300%2Cregular%2C100%2C200&subset=latin-ext&ver=7edc83995d8ff3030fe1a7910eff6904

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://fontesk.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:15:42 GMT
x-content-type-options: nosniff
age: 274926
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21796
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:35:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:15:42 GMT

GET
H2 200 7cHqv4kjgoGqM7E3w-os51os.woff2
fonts.gstatic.com/s/barlow/v12/ 20 KB
20 KB 126ms
77ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3w-os51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow%3A700%2C600%2C500%2C300%2Cregular%2C100%2C200&subset=latin-ext&ver=7edc83995d8ff3030fe1a7910eff6904

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

815f02681d0fd52b5f52e8c3fca5e754fefb3c83c2eed47b63fd3c3228628cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://fontesk.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:23:14 GMT
x-content-type-options: nosniff
age: 274474
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20712
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:55:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:23:14 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
251 B 98ms
37ms Ping
text/plain 216.239.34.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-445N6DQJQ8&gtm=45je3ab0&_p=1885064267&_gaz=1&cid=2063783378.1697409469&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1697409468&sct=1&seg=0&dl=https%3A%2F%2Ffontesk.com%2F&dt=Free%20Fonts%20%26%20Typefaces%20%E2%80%BA%20Fontesk&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-445N6DQJQ8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:48 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://fontesk.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
251 B 106ms
41ms Ping
text/plain 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-445N6DQJQ8&cid=2063783378.1697409469&gtm=45je3ab0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-445N6DQJQ8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:48 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://fontesk.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
408 B 108ms
44ms Image
image/gif 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-445N6DQJQ8&cid=2063783378.1697409469&gtm=45je3ab0&aip=1&z=705317954

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/ 393 KB
134 KB 146ms
83ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5952306940031097

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

bf09c167e2eff72ba45c25dca75d677c16bd048d9589832afe38cb30bcaf836a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 136584
x-xss-protection: 0
server: cafe
etag: 15920440419808273087
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:48 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231011/r20190131/ Frame 0643 10 KB
5 KB 93ms
32ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231011/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5952306940031097

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 65210
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 04:30:58 GMT
etag: 2603938475786422795
expires: Sun, 29 Oct 2023 04:30:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 slow_smoke-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 24 KB
21 KB 39ms
37ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/slow_smoke-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 631c7291c16092cef8100ae2c930b787bb8d403ec0aa5f7a0aaa8315e1c79aff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Sat, 14 Oct 2023 09:06:30 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 21417
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 saiba-3-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 54 KB
49 KB 41ms
39ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/saiba-3-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: d2457f8da7d5b9d2cbb0ba84378e99a9e426fc0bfe41ed68bcee8535aa38c416

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Sat, 14 Oct 2023 08:40:08 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 49719
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 bulbly-7-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 240 KB
239 KB 44ms
42ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/bulbly-7-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 528804f12be9081fd9c3590eeb702ad54cd8e73aa475c5590a74e3e0a6151f1c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:47 GMT
content-encoding: gzip
last-modified: Sat, 14 Oct 2023 07:58:18 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:47 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 389 B
533 B 40ms
40ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=fontesk.com&callback=_gfp_s_&client=ca-pub-5952306940031097

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

cafe /

Resource Hash

cfc4c2a0dd286b3ae6a1f3e0b70a611fa1182770bc945e03a0b1803062fa5f37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 258
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BABD 46 KB
17 KB 923ms
922ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&adk=1812271804&adf=3025194257&lmt=1697434669&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Ffontesk.com%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468749&bpp=6&bdt=367&idt=222&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5245609155967&frm=20&pv=2&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=275

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

38a862b27591a933405008c26eec102821fb0a4492c0f75b79ad3c21e8a95173

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 16879
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:49 GMT
expires: Sun, 15 Oct 2023 22:37:49 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7990 100 KB
37 KB 1348ms
1348ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=9027243322&adk=525839248&adf=309123476&pi=t.ma~as.9027243322&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468755&bpp=2&bdt=373&idt=274&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEe%7C&abl=CS&pfx=0&cms=2&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=g01fZs71po&p=https%3A//fontesk.com&dtd=281

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

2cd2a0d2ae4989b9ac86e15ef133ff27a2ce1cdbda83419e0489e4f3bceff9c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 37662
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:50 GMT
expires: Sun, 15 Oct 2023 22:37:50 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AFFD 25 KB
10 KB 733ms
732ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=1389527199&adk=3956400729&adf=2752187097&pi=t.ma~as.1389527199&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468757&bpp=1&bdt=375&idt=294&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=799&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CovEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=r7Kdp7j61o&p=https%3A//fontesk.com&dtd=305

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

225d27018f230a36201b9ef518df754cc8d7ce7fd0cb1145ff3c9aaefbd8abf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10219
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:49 GMT
expires: Sun, 15 Oct 2023 22:37:49 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 bolupisang-2-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 67 KB
67 KB 42ms
40ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/bolupisang-2-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 9d845c9e205266b115edf3be61059f1ac165ba22ba84911b25175e45c845b23f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: gzip
last-modified: Sat, 14 Oct 2023 07:37:10 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:48 GMT

GET
H2 200 Intradistaff-1-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 54 KB
51 KB 49ms
47ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/Intradistaff-1-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 9c1cb588e62a0242cf7fe7cd297b3fddf1b237feb5bfe54159769b4e734b6783

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: gzip
last-modified: Thu, 12 Oct 2023 09:31:46 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 51936
expires: Mon, 14 Oct 2024 22:37:48 GMT

GET
H2 200 wolfsfifth-3-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 34 KB
32 KB 28ms
26ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/wolfsfifth-3-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: a023ff6658dee5aa71f1d92e83eaf4e5c8f6fff3a5f11f3675d0a2ee8a311b7f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: gzip
last-modified: Thu, 12 Oct 2023 09:19:56 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 32551
expires: Mon, 14 Oct 2024 22:37:48 GMT

GET
H2 200 typologic-1-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 177 KB
176 KB 34ms
32ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/typologic-1-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: ef6a9d44d0ca2a61e2b7ce5277a5bca9bdfb71ce6d743237e32d467efb75afc8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: gzip
last-modified: Thu, 12 Oct 2023 08:55:37 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:48 GMT

GET
H2 200 beautiful_feelings-1-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 99 KB
99 KB 33ms
32ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/beautiful_feelings-1-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 7c82f397a0ac147e592493d7bc8889388ad6ae2b65d069c39222e0ea24385eed

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: gzip
last-modified: Thu, 12 Oct 2023 08:26:04 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:48 GMT

GET
H2 200 cruinn-6-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 82 KB
81 KB 41ms
40ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/cruinn-6-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: cc5025ccbf36f2827a60152181b6b8df32e15fa5a5926b70f8f0b97d073f3881

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: gzip
last-modified: Thu, 12 Oct 2023 08:06:09 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:48 GMT

GET
H2 200 imperium-2-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 28 KB
26 KB 41ms
39ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/imperium-2-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 1da91e1e602d2ed0a0e999aabe29b9033dda4a44c492b20897152fe1d2dbc7c8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: gzip
last-modified: Thu, 12 Oct 2023 07:42:43 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 26122
expires: Mon, 14 Oct 2024 22:37:48 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame FE03 24 KB
10 KB 635ms
634ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=8732050345&adk=1761106037&adf=2584966758&pi=t.ma~as.8732050345&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468758&bpp=1&bdt=376&idt=314&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x90%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2667&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CovEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=hGnVLPzdXz&p=https%3A//fontesk.com&dtd=317

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

e323bad19d6fa0da7a34af462c4c5191dcbeccf66ca1c45cb70f81e0c8295f2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10032
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:49 GMT
expires: Sun, 15 Oct 2023 22:37:49 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 00D3 24 KB
10 KB 576ms
575ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=9786891966&adk=1700949682&adf=1429666621&pi=t.ma~as.9786891966&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&alternate_ad_url=https%3A%2F%2Ffontesk.com%2Ffooter.html&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468758&bpp=1&bdt=376&idt=324&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df28d7aae89707d1a-225947c997e400df%3AT%3D1697409468%3ART%3D1697409468%3AS%3DALNI_MaItdktrxAmdX4SzTAd22-7GRXDIg&gpic=UID%3D00000d99eab73a39%3AT%3D1697409469%3ART%3D1697409469%3AS%3DALNI_Mbeki3Ru-7d-U3dT_JYZZMtqFRvIA&prev_fmts=0x0%2C1200x90%2C1200x90%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3421&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=KzRDuky3LM&p=https%3A//fontesk.com&dtd=328

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

7db71de8593ed0813a1c6b5b676fc56098b793915e9a12cbd5f1aac4517e270d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 9896
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:49 GMT
expires: Sun, 15 Oct 2023 22:37:49 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 stepalange-1-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 99 KB
99 KB 23ms
23ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/stepalange-1-590x332.jpg
Requested by: Host: fontesk.com
URL: https://fontesk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 306309bb97dd5c43752d1a3f747d956dc5b1ce7ea3b9f63ce50b3947854b0b5d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:48 GMT
content-encoding: gzip
last-modified: Sat, 14 Oct 2023 07:46:49 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4ADA 624 B
246 B 47ms
45ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpL6JAhidiuHtATAB&v=APEucNUARvtsTHq6F1IO5JuF3jrD5cTyZhDMsDjJOe372w3g_hT3nocPoVSHwbJl30dAMXvwFXHvuVVZWSKmiH0T3eY2rA6Lug

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=9786891966&adk=1700949682&adf=1429666621&pi=t.ma~as.9786891966&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&alternate_ad_url=https%3A%2F%2Ffontesk.com%2Ffooter.html&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468758&bpp=1&bdt=376&idt=324&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df28d7aae89707d1a-225947c997e400df%3AT%3D1697409468%3ART%3D1697409468%3AS%3DALNI_MaItdktrxAmdX4SzTAd22-7GRXDIg&gpic=UID%3D00000d99eab73a39%3AT%3D1697409469%3ART%3D1697409469%3AS%3DALNI_Mbeki3Ru-7d-U3dT_JYZZMtqFRvIA&prev_fmts=0x0%2C1200x90%2C1200x90%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3421&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=KzRDuky3LM&p=https%3A//fontesk.com&dtd=328

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=9786891966&adk=1700949682&adf=1429666621&pi=t.ma~as.9786891966&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&alternate_ad_url=https%3A%2F%2Ffontesk.com%2Ffooter.html&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468758&bpp=1&bdt=376&idt=324&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df28d7aae89707d1a-225947c997e400df%3AT%3D1697409468%3ART%3D1697409468%3AS%3DALNI_MaItdktrxAmdX4SzTAd22-7GRXDIg&gpic=UID%3D00000d99eab73a39%3AT%3D1697409469%3ART%3D1697409469%3AS%3DALNI_Mbeki3Ru-7d-U3dT_JYZZMtqFRvIA&prev_fmts=0x0%2C1200x90%2C1200x90%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3421&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=KzRDuky3LM&p=https%3A//fontesk.com&dtd=328
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:49 GMT
expires: Sun, 15 Oct 2023 22:37:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 5105 89 KB
31 KB 74ms
74ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:49 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 5105 3 KB
1 KB 105ms
43ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:12:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15891
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:12:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 5105 20 KB
8 KB 107ms
44ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:30:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14823
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:30:46 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5105 187 KB
59 KB 35ms
32ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:49 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5105 42 B
63 B 48ms
47ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BLeHsFDNQcd068xMAb8ZyGH5kEADwXyzBpdw5X9nVMqf7qOhawrkMQmSSjnFn0_CHKLAH40Kv5UnoxhRuLtfpiHK3h0ObKxr86oyIHoztCb5nuPzE

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5105 0
20 B 47ms
46ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=15033693941344100605&x=1&ct=76

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 593F 624 B
246 B 47ms
44ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpL6JAhidiuHtATAB&v=APEucNWuqp_7CPtNfQWzd4a_wepXw2mu_cFzJ1le5bk8GEHkrEgBmtcn6yHkF_J4RJH4Vx254ogV71MaoHwIvD4IXjaEKsmu1g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=8732050345&adk=1761106037&adf=2584966758&pi=t.ma~as.8732050345&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468758&bpp=1&bdt=376&idt=314&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x90%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2667&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CovEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=hGnVLPzdXz&p=https%3A//fontesk.com&dtd=317

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=8732050345&adk=1761106037&adf=2584966758&pi=t.ma~as.8732050345&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468758&bpp=1&bdt=376&idt=314&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x90%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2667&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CovEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=hGnVLPzdXz&p=https%3A//fontesk.com&dtd=317
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:49 GMT
expires: Sun, 15 Oct 2023 22:37:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 5944 89 KB
31 KB 65ms
64ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:49 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 5944 3 KB
2 KB 48ms
29ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:12:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15891
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:12:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 5944 20 KB
8 KB 48ms
30ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:30:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14823
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:30:46 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5944 187 KB
59 KB 37ms
32ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:49 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5944 42 B
63 B 52ms
49ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Dk3CtQB0z1ItsV8Vi1zqk7-8XrM92b3MPTv1TZSgU-AB9mYBFoFKliqVqNgYZI0kXHPDWpz9ZXhivboNcs208X8y_-6plWSpbO52uuYRlhVKc2d-g

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5944 0
20 B 52ms
49ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=17534240720175228477&x=1&ct=76

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4ADA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ydf9S-BoboQ5Fs9kQVE4&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ydf9S-BoboQ5Fs9kQVE4&google_cver=1&C=1

43 B
737 B

70ms
70ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ydf9S-BoboQ5Fs9kQVE4&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpL6JAhidiuHtATAB&v=APEucNUARvtsTHq6F1IO5JuF3jrD5cTyZhDMsDjJOe372w3g_hT3nocPoVSHwbJl30dAMXvwFXHvuVVZWSKmiH0T3eY2rA6Lug
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qb0R%2FxTVny8%2FwF8ndlnbwpAnceRESb5108nhXMtC17tBNqlQH%2Fk1SV0Cwm%2F8OGamxguUkG9iEkf0hbuah7r64MnM%2BP5jdNMTkQEIOL%2FTKjsfT3ptWsooqYkfkorHprUCTJ7oPzEsTe%2BNyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 816b8c82fd0f5425-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1L7WH3TsNNIJ7crSUkPvrf7ueWqJBsCK9MF7rJW3nzMKYmPtnpfuz2SIEpUhWzaXjtHGFxDnEvX0nP56tRew%2FYWhZCvRCLjXwuamQqdNneSgE9K726aCWZRZjQaxv4eTXJy0D3fugDt3sw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEM6ydf9S-BoboQ5Fs9kQVE4&google_cver=1&C=1
cache-control: no-cache
cf-ray: 816b8c82af0239e1-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4ADA
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZSxpvQL.3eYgkGRQn9FFAwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1&google_hm=2

43 B
740 B

64ms
60ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpL6JAhidiuHtATAB&v=APEucNUARvtsTHq6F1IO5JuF3jrD5cTyZhDMsDjJOe372w3g_hT3nocPoVSHwbJl30dAMXvwFXHvuVVZWSKmiH0T3eY2rA6Lug
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TuMtJl1y%2BPZbugoW57FZ1b%2FOWZkQ07b0BwyZbPyP6mHlU%2FJnF0zZfRKUEVbTvK35Hz%2BAZMu2WXCcTjRFnbRvi1gyyRM3isJTPj%2Fgqn8TQZO1ROcaBV%2FiVvRCokM0%2FNaqnLQhbeESjxtO4w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 816b8c83be415425-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 4ADA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFzzHHZkS6p0HleOle8q9ag&google_cver=1

43 B
840 B

42ms
42ms

Image
image/gif

68.67.179.155
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFzzHHZkS6p0HleOle8q9ag&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpL6JAhidiuHtATAB&v=APEucNUARvtsTHq6F1IO5JuF3jrD5cTyZhDMsDjJOe372w3g_hT3nocPoVSHwbJl30dAMXvwFXHvuVVZWSKmiH0T3eY2rA6Lug

Protocol

Server

68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
an-x-request-uuid: 51a6841a-b04f-4a92-9213-b6b6d8988497
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 45.88.190.16; 45.88.190.16; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFzzHHZkS6p0HleOle8q9ag&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 4ADA
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc0NTI4ODcwMTAyNTI1OTA3OQ%3D%3D

170 B
232 B

42ms
42ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc0NTI4ODcwMTAyNTI1OTA3OQ%3D%3D

Requested by

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
an-x-request-uuid: 92a4bde6-096b-415c-8e10-a24e83a007cf
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc0NTI4ODcwMTAyNTI1OTA3OQ%3D%3D
x-proxy-origin: 45.88.190.16; 45.88.190.16; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 593F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1&C=1

43 B
776 B

60ms
60ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpL6JAhidiuHtATAB&v=APEucNWuqp_7CPtNfQWzd4a_wepXw2mu_cFzJ1le5bk8GEHkrEgBmtcn6yHkF_J4RJH4Vx254ogV71MaoHwIvD4IXjaEKsmu1g
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UlFbZqTJ18k4xDf7%2FhbXYFNISgYh%2F%2B0Cqb%2Bec%2FsXHpYOH%2B22Tpfze%2Bk5BS1WMnZ33fpVcSSlk%2FkfFEs18j4rtYjNjlqWSZXuzbTR5kLA83zPaH1n8WiIK2GKaFtN2sJd7YjcQF1VVCSN6A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 816b8c82fd165425-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kzPbQAoWxyc104jgX0bNUn0bh86eAXkCIKtHHeHDpqJvWun6x%2FjPobWfMbuXEQpy0dnxgFM0%2FV9G9ROEHGaw8Ji1TUd6gxH8m3eD4rhXorJePclCAXQ90KKPchQtoGY%2FU%2FauIyp6y7sDSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1&C=1
cache-control: no-cache
cf-ray: 816b8c829f0039e1-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 593F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZSxpvRhNYXnbwXFZ7fDzWgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1

43 B
732 B

65ms
65ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpL6JAhidiuHtATAB&v=APEucNWuqp_7CPtNfQWzd4a_wepXw2mu_cFzJ1le5bk8GEHkrEgBmtcn6yHkF_J4RJH4Vx254ogV71MaoHwIvD4IXjaEKsmu1g
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sDOvMV08CnSjMDZp99YiESqADQ%2Ff7gv6ULoaC0Xh2er4XHjaoNDGyLtdLvS7w3xk5pHzXHFuI9szkm%2FZQmsCN8EkLx7q0EhCfLQIy97D7nsqcoDB5Oyo6fbX5bWSeEIG9uPA6hebgPAQQw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 816b8c840e8e5425-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 593F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDfKLK3zqhtJ3FmnnZ2_xQU&google_cver=1

43 B
838 B

29ms
28ms

Image
image/gif

68.67.179.155
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDfKLK3zqhtJ3FmnnZ2_xQU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpL6JAhidiuHtATAB&v=APEucNWuqp_7CPtNfQWzd4a_wepXw2mu_cFzJ1le5bk8GEHkrEgBmtcn6yHkF_J4RJH4Vx254ogV71MaoHwIvD4IXjaEKsmu1g

Protocol

Server

68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
an-x-request-uuid: 98dddc84-4b2b-40f9-afcf-8944319b4fa1
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 45.88.190.16; 45.88.190.16; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDfKLK3zqhtJ3FmnnZ2_xQU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 593F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTczNjYyNTE0NjI3ODMxNzgwMw%3D%3D

170 B
243 B

46ms
44ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTczNjYyNTE0NjI3ODMxNzgwMw%3D%3D

Requested by

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
an-x-request-uuid: 288c8ca9-a08a-4d84-9fdd-fac93bc75356
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTczNjYyNTE0NjI3ODMxNzgwMw%3D%3D
x-proxy-origin: 45.88.190.16; 45.88.190.16; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5105 0
20 B 44ms
44ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4117938219453&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5105 0
20 B 45ms
45ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4117938219453&version=m202309260101&ct=76&x=1&cor=15033693941344100000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 5105 80 KB
37 KB 84ms
83ms Script
text/javascript 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A8tzgadDkizdJFwf6UosjtJIzcGNGUi-PFoyMRHFcI3Chs1bgX9Mcxt21xLvdKKmi_dm1rwcJYzJNOXbvwfSmz_3MtVQ&cry=1&dbm_d=AKAmf-CFL5aZBn1JQpgo2Cy9AZfLHjHtb9T-nx0Wy1AlsirVJlhs9QlgEet1RbIKzv8MVi5esJXOdnViJTHVW1fKEPAq18sdcr1TiTzh5bGua1AMDPKn4Vs6ygTGr7DCSMaB8q0uihF8ELjYwSVXAQTF4jTOyr8tX5kTTmRO5LP1yK6k2InoeJfEGAM6KVPnGy_ENSOcSqabbW683J8DvR9jPuAHEn9H3QHWOH0kIrjsx7vubBxFEjNYnczbIm4UGR9h5otFB--b6trxkkJzX4Q2JR5s_OoC8IfKpgOHZfvkPrG28DinIBcubGm6iwBcPjgOzbdh4_qRilNZyyATRlotfOmTtcG_pDBipFvVqfRBC64At4_QUWxNMR7iE3oTx1CbyJt5mkfiC5WFZPyAY3GBbfRPL_V4_eNL47L-RPXWlWoh5sW6FAZvHxYjt7JywuKaTC4WAV5AsHj2Ze8mEp_XSWnj--u8gNXKru00OWpJoMPbJHlDthR5PU3IH5T_fbWOdfBJaFkWk6BiCwlEkW51KXDv958EYmxJuXvYJRkM__HnMi-O9FRij7qASAq9pyJwkfXCSGwJhXXL6fPeRh1r0wvBd5KLjdUrzS7fsKcoM6jc4pgi0Fkg882Vg7DVFb3xYlf5OX8aojExZ-x5o_XmUncYvB9h_rlEjhr6atxHjYBIpKhqnfqe5fyCBcAHDFzcdfHbgO2HK4TecdTZ-jtbmSSCfDjD9foAycJ7GGYECGu3s2x_Depfm7d2eX-g1bhplloVPwcjdtGoa3nBYWX9UYCibLxQa6Cd8RaHCzBvfAbVTcNKrw-otuIzOJuJGa2AVzlaAHaj6fgf1-hb4iBrhGVzYCoSdWwBOR1RDB1BKW3FmAXa7utVEoBCXk9GEkxZv1LzpfxrvUhPqnJDPxGkoCLzrWo_ntq5f2ct8eUAGOJ-VJQ-JfwaOpbScsE6h1OBlOMjqSFhMI9IbZl5rDlVs2P9OVL0E2nO6gCBI0M36Sjr-7ahPSbw_AFIHnx0CisZuAMN6vH7b85rRMtQJi12gyZeIz0kTwgC1Kh9mO6t_ky4485DdMZn5trxLEGk9o-TX719BZ8j-Sc2b5U9zQTAuj-bmcdPKB0Fg-05A_LgefTbCVbveLMDRl7gyM7--eeW_6EuJ6eWrmC7NgF33nHNb6s9IVmVw2G7Dba4luMIQ0Wc3NjR8ciVyA-lCdunoybAh8GmuqK3WUK2vb3hOzCcJi3TJh8JCcs7jStA9QBbt2lh_RmP87QWSu0di1_lgRaq8YHpVTbpFjvrpsmQ1_GPBVDCJavLiISBWFv2Ck332WNB1qqZAtFlENmcrlnCI-LLSyArTlJTOEWHOQUpHU3FI5TI9sUXUKbpgH2rMCllEKlTiXkn936ICU7Br67C9lYqKchV9C_91BYLJkcN4RSvR87jV8KCniL2JqRFlepXkUcqjvqHdlvIqajT4s94hTEZDxE2zzm4Uz6sGHtwGZXYzZr5LcFm0wwnfquk2-dlYLb7Xsgul-sgDzItltigZPUS6UUFGgdNkzyMyWi8te6xwujJP306Tt_fzToB_LLftlb1o4ZQ7jt5lLVu6Bm-z2agfOBfoKlYi9HAw4b2Cam62x-EKNjF8EFM2tkYoBU2ogbVLUZ0rBrvh2vMR4bbBMDa_M4qBVViaG1x9yj0PNBG77gdNVcYa7QSNqvLGgXr_6xOAH_NV9BvYlXzit1uiTjGp_jIHH_pfPaDZeAtkXjbDAwZURa1zuuHM0KgAENHqQz94qt-luvBMDFlvF1cPYc6VMTveEZLZCqmJZ9EGWw-gEduXATJFM-rS6ctQeOCxFl5mYBS_DoZTqI0kNVQr4sMoPjAAr-JmCsqHuV2EKfigp2Y9Xg-BFuELM1t4zPaJOIrP2N5KZM0sVsk4of6Owy6DpAX5nLW36qsFdtpEJRUUliz6vUvdip01j6UB62A8weBVySRgXDcuyGfx4CEOHY28xcX7iNbQxD1uOlgaIm6UDlPHk750f-PNcEdu-evWSjGLCqwXVkwow4Vw6PusPUTJAK1YXkFo5YoVPkVO7KN5Qv9b1bZRGJqThi30PJfcAaoiahKMjdunx-83VxDFwl5u8MI88YW0OkABskD1FoQ2xOSbSXqgNco9iD0tpKLn0erEvI1mGgCBACVPHEUPj6sHULKUb1LA80fyKiNDoZLeBesBDLXmbGnGHoWlZIga_TF2aAQ0LZNPPg9ILbQwcZ4uzOQ6EgK8AvMvi6M4-jOwGhFgjGdcLLUwfUJNWoa1HmGpTv1V1cQgp2MYaBnNClU7K1laq05f8bc4dUIrrf1cbTP9yvzI8VyEOE9Rs4-KUMtfhKuXZYBvoRwjHBeQ36QX8Z3XNmCjLSAz8uER_CGNMLBmnrPNeP31LeuTFw_BdyJV7u93VkQHZkx7-s6JPDlpoyQJjFyU0kS3BKMBe4ZixRVyAqToSzuoRFK85yHHJ_1G179kwe8-xII3S8kcaV-2-GHK6wogtG4H15_lM71-aXNFcAg6NKLyXzuLHHQfNKgt2Kdo2MlKOHWw-WmTcac0Tp4DwO87Ozifd8bHtFs8RcXl85fWgOVt76aNV4CeTVo8QCQKVCF_zQqDBTi_Q2yvzvSPMohCVB5IiwngKDQATDAwvCnIli5mx4SiEX2GH0hkWjydY44VEI9cJYkEFJ-gzLCNBtBcOe-RQIrlJpOqZd-OGdbjM8oKdtLdgD8gwd5vzkkoVR-6SlUVZD_T6Y1gi-bcXLgtSTbDEfWcQe-d5k9tMbEf4RuVQ_3QAyyNy32OPeB-i6GD78qmgu-fNly7ZPUKnrFyF4tMg1aCYGIblkztzNLmUKWuf409Jb4ce_aQcNxOpAnz8Wm6ACnW4Fy4OF00SACLEKGTNILIfRlqRXJhowKIm-SSClnQFeDRlxDbOhN85DbNHeJVhruRBOhPs2g9D-EVnCERzeV4G6tETNOLiD_MQT4SPP48yVEZGIMEYHJGYaZ_9hzIPrXfHpwdbTpJmDJO-L1El_cinmhwSGeVE_-EQAw0SX4TyiGJNJRU4nHMxr5ZpvxDOElwm8BM-T_UGqDN5B368q4H7TXtH1lUCSlML-lNBj7CZAFJECz35qex19vgeekFG5ow11jLjdTgN4LxY4bBKn1w9tr4nhl7Y30d9LdNWsZy_PMWeALVHVUqIajgpWKsn0sdwH0xGIaZ6kunncdm8AgkTXwePo_M_TkGP58DQZwyHth3IkWTJGTWem7jwc-mEeVL4BL3q8WmwIGYnx2MRZBJnkMHYa6qbLTx8xfL0k6E2GltO06R8ftOT9Z3jpDuNlmkkMngwkGxk1vhoZQ14m29y7sShf5Vm20UIgY_2tsCGUpTcNa3hYV-pMdWf5MrGyG2cbscG-4d6RrcPpRGXUZwvA7_lfI40srLzDY2r29U_U77EPMgkkj7SQ&cid=CAQSTADICaaNHj8gfIVYSehToKRJpZzdBiumUE-pklVKTqxK_wprN2OGbhKJTCR8WsWl-6wysaMI98RX4vh9ByDG1izHcs2V_LssW-xjdfMYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffontesk.com%2F&ds=l&xdt=1&iif=1&cor=15033693941344100000&adk=1726166460&idt=97&cac=0&dtd=36

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

ebb775e5f2895db88b2bfa53a935487cfc95fe2023cffa65be421ee258cd45d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=9786891966&adk=1700949682&adf=1429666621&pi=t.ma~as.9786891966&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&alternate_ad_url=https%3A%2F%2Ffontesk.com%2Ffooter.html&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468758&bpp=1&bdt=376&idt=324&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df28d7aae89707d1a-225947c997e400df%3AT%3D1697409468%3ART%3D1697409468%3AS%3DALNI_MaItdktrxAmdX4SzTAd22-7GRXDIg&gpic=UID%3D00000d99eab73a39%3AT%3D1697409469%3ART%3D1697409469%3AS%3DALNI_Mbeki3Ru-7d-U3dT_JYZZMtqFRvIA&prev_fmts=0x0%2C1200x90%2C1200x90%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3421&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=KzRDuky3LM&p=https%3A//fontesk.com&dtd=328
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37570
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5944 0
20 B 44ms
44ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8668610616940&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5944 0
20 B 45ms
45ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8668610616940&version=m202309260101&ct=76&x=1&cor=17534240720175229000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 5944 80 KB
37 KB 94ms
93ms Script
text/javascript 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BvI1Lx4qwtpU9nVnWwQIwc64i3PMbvkf6gmcJzUvDs1u44lec21MZ-TYediC6UxiN4j8lT9TGZMbpw1oJjZypHCbSbTw&cry=1&dbm_d=AKAmf-AN_Y5lfjlWGxplqe40_IqALXfXBNVijLNKcs2kR9g53TX9AMOONtlprkabkhbwqol-t3Dry_1T71EzQd-fU7v7ymQuNf4YZB2BCACtd5sJeAKWZ-W4dea2rKlBswUgcbrMiwfHP0iiRKkODMVLxRL3q44dYqsY25txaOYPPNK0h-3_vL0KTW2FsEiJw27SGodj837U1JF66eUoS5Md8J3mkJK4PuJtXZsCu3l_ngQAXQbYcbnDtg6QBKx34lgHofMzVECwx3Et3rjEYZ8WkOFmbV0c7wKUbi7LJxsNvZRJKJkPH_JycGJNkB1CQdhlzhfqRHafgTVrXBh2vYke3b1TvzEA19EHwDdqyJQ21QX237zmuFE2ZYY27A250qpu4NCA1P1w6WogM-loE7SNp5sxTwuKkL5xLAAKMNytyTANSUssY9HpgEvApWZZ6VL78elhpU7OzPtxmzWd6LAijRcSZqqER0O46t6djkacfGAvURbdTwe8hpi38iqeUx_5kfsMGK6omxzjalWpXcbexee1BO_GJ8ZmLlP--lLE2aYBB011ZtDeTKy8BJnz9wLqYqS-ISu3MrlYNfabWe2KzpQYpLBmY515h2-4NZ3FoWbaNCB7AylcKgWV8hJa_4kSBeeBT_XV6oVu3vpbz1fHFsJT4DNl8rZZz1P_93fq972aFVtIuOqR-Oml7vA_JrwGypz1aPWAcHsdQodJKevaQ_xUqmGs9HvJAn3dZtiHtj0dvK65Yj1gkKp-vxU8wzxypAj5ypnhgyNdRVqBXMKEPUpjkyw0MUH9XU6ub4Qv4DZapMd39afnx63sOvzr85Dr4mGNufTXcVv53xiW1mqREbaobpM08tyARIABGSRyB6ahVrfpFfEbO98hP0dCDOotzXjrG1j2TxiRct7e-nfv6Pl5RrRkhTO08dWjn6rArZUUE6bF906mMXLA-s8pQPKVj46bvs4iOxZcqFyCRakrqrxuQMHtOkl63kkFvVpmzynhNHIsP0PcOK9HY4xOiHEHPMQQ877TNqxJWQOxJMBIZiDcT0uVHKYmIIGpERAIenKwxs2d_9o1WebcMAfSt7Fy5w-W2DOXhgJrNyxTsrAw3kryEuqy-4mEohr41U6vq9eMF6WDnbqut3V90wSIGNAs6rDyM8YFlaQF4FjP7cPpD-D9Lv_Q_Okkck9R2eq1EDO0n6EijBcotoBd0QO0om7NKsbKTm4vksVK8dW8FN5zEcnM8DP3Axi1DXeW0q9v1XAWGbRRk1VUYOqDjf3KwsE_DEgEezZ9NIwwrEQ0pt5-DLhvcxty5FCVy8pskXJm6Ho_eZ9us4i8WFs9TFpngpHVZ72xrpX9TbISF8mTYY1xOyQLKSHX92QczBNK8HhUPklTZbrSW3JiOy3QCd5924U6Z3Waq09JOyjfSvhUXEQ-E6JZ4Onz9zGZ06afiZKo6Kp1X_MnL-H9xjdQhvmTqb0PAH4_oQEp8bwTmiKnF2BMonhOturPPwArCWHWJiHhXS_sTvZA7hzNjjmKkQ-9vLek6_68qO94tDvRh949nAjBInBwvKNa9TVnyYVdmnq42OPl_zQTGaJ8OHK6vhYrUITQ9SX7KTYhSYPHz_Im_HH1n1t0dFOZ-CTbLAdUFIUyqig7nlDXD0wTZHaSmg9u9f74ZEbcS774ldSqcKzxivxuwcwsafsbhPuZM0HcxvX_sZ0jKt7Sl7SE1YSY_u8MtD2FNKn9qeS4lLINbEuIe2DuUakjl-7Aa1nEkSpd1X0GAB80S7znLuEFd9hSetVwYaSn7VGdwGLSY1D6HI989mABSnhf_ZVYrTo1tbS5Wl-luWOnYI-T9_wxLaZ2kUUZTgsUYPtIKbNTc-y1QUtGI_E3gkm5CawdawChhiCP0MQ7CoUVpXPx2us3QesenzJqZTK6AhGLAxLu2gOOgTZzQlg0DQ7K62mO1B04R4JDl8iJk8PKVKbZcdvxaEMzQ0jYEPceNY65wYFXALM9ouO2SgraEJW1u0UsJMAUyHy4DavoGC8rwtpyhyRB9MS18sTyTZH6y5c88mNvt1YSG6PbreVWa0TEvUwczYLX_Ljfi6Tx75Ol4d3InRj6n7g-l22mO4sankqlV7_RsSvWjc6ZNFZvrqUT_uXXnhfRwHd0Kk27lcCEtg6efph06Xce7RGIYWoq0vjRPU8AfustWtpqOgT21D9xvoyA4fBElce4adZzscRShzHDpZrYT32MwsGFAp9XAJYpbcvLM0BBZOX9cV2IvEGZDb91JdRcpHoDltyPQaEfmPmJoS__jxxyIqlTVDkIHIzXWmjCrmJ-9kXS_xu9ls3nEdEWMveYOkprkItfKDZ-giCjjjNBH4GYfMf3yYtf0redcFObgS-6bOCx11HmJBMpcXxHItVNQuRxz5rumJCRuDKb2qyecSB2626nM-eMiCpHkvdp1y1C9ba3ntxn8QNhdG58AHpKaXQWMARgrCpu6TKfOcyychuV7YriBHV2gaGZXAW26D4vIlBJcdLNVm0cFDDjFd0dvlAAMfddYNVPV894yG_UfkViwZkyZsB7lefI1B9AjvhMF64kcDR-VxXh60jo4avPOs27pkqUJhvkHWvZf1F33slkxWRjeP5m1TxoHsYuq-R2YwH32jR5Ox_blMCbjwu4U1bWCFoE3olx9M1BE2zyM081LZSwbO_JNqBQvmJl2Gez2Nxyws-nWAerL7a9mWkuLZijCceoVHBQzj-1OyJkVGMU1U-cpvNN_JsIuFLSpmhR3Kbczdu3J_XZsT1NxnFeBdqI6ti1SBAqDGe8Qv-0IDcTZf5xlscOk31crwKySDHxKP2jAmTgByO5dU2zNzIAouyJyZLozuEm62CIF9c8ajTcUBqn8eIadlm9nsUWZOZI3M1_w7e2ZAO7bg7eCuL32MHE2GlP9CH6dfnGG188kmcEmuboA4OZWit1-qQ-RujeE-c5fe2P8eb-yrg4gVnBi468xascVsMMKw9Cg60PtzDV_L7kxAIXFb_wjGNAfvA90hZONYHZ-AlVPbDbvH2M2abC6Tvlv_5P92wizKya7c4zP6xFtGkXJDeSgZ6Tz5Fo_R8ivwquLJdk3XrrvEgzw3eFIu9KbtL1VZiKRT3s9-jNH4ud0H2OiZP9BShv757I3LBhgPq-DAQxX1AJFdR24PU9DbvYv6Zc-POjzwsTcicI0br2kynId3DuUJcwSImt5A78JJDvtdD64ywjxPbaZkeBXlPcb-FyKE4dUap6SvIqQDEeb7YmXLLuR70x_7Lur_sQ2-4pw0YKG68uKka8Zytq6qrrZAywyO60-qK8EqKPaTeciG2XNnxONK4xpBsTHp9P5dihOoJTV9JOlkwiAGKrDAdlOJnZs9bUZWdVulaHpNBHetcook86UxcTsp9Lvd0ic57HjxbHLlu6-7gQIYhtFTBT69U7sK0XkFZd19J8ri0s005Pa-hRchll&cid=CAQSSwDICaaNu4D-lAmkL5E-3cdY77Eo3BH3gXoCrsir1RBZYX8MCdX6YFBV37GSJtuGa0rwrrRkbQXzsgJjN4Z7vamTA1_ThbelsQA59RgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffontesk.com%2F&ds=l&xdt=1&iif=1&cor=17534240720175229000&adk=1761367587&idt=80&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

be8125fd9d7140c9b4ec7cb377b9dea121d067fcac6119c4f924d0da3617c135

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=8732050345&adk=1761106037&adf=2584966758&pi=t.ma~as.8732050345&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468758&bpp=1&bdt=376&idt=314&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x90%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2667&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CovEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=hGnVLPzdXz&p=https%3A//fontesk.com&dtd=317
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37603
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4321 624 B
245 B 47ms
44ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL-7v_oDEIC9jf0DGM7N0vkBMAE&v=APEucNXDNRRQ6WbHK_lh7SSFnpJTW6_-b250_6R1j7hgKie9ZfN61vaqw-cpJgkQVQPHztgiCowS6HWyGNle35fb6yU8A69-xg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=1389527199&adk=3956400729&adf=2752187097&pi=t.ma~as.1389527199&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468757&bpp=1&bdt=375&idt=294&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=799&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CovEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=r7Kdp7j61o&p=https%3A//fontesk.com&dtd=305

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=1389527199&adk=3956400729&adf=2752187097&pi=t.ma~as.1389527199&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468757&bpp=1&bdt=375&idt=294&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=799&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CovEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=r7Kdp7j61o&p=https%3A//fontesk.com&dtd=305
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:49 GMT
expires: Sun, 15 Oct 2023 22:37:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 63FF 89 KB
31 KB 57ms
56ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:49 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 63FF 3 KB
1 KB 34ms
31ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:12:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15891
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:12:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 63FF 20 KB
8 KB 35ms
31ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:30:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14823
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:30:46 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 63FF 187 KB
59 KB 36ms
34ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:49 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 63FF 42 B
63 B 47ms
45ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DG09QMqsbTFd1ZBlfr8hq-h2KOVt97OWUQ43jfsy8Mj3xv3swl6QiHYH-RxpZLc86_RZ9R7euCr23zAFKyeE8ImFufBjtOzAdMEf7BeBjHR9bXhCU

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 63FF 0
20 B 48ms
46ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=1471633618171313451&x=1&ct=76

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4321
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1

43 B
734 B

62ms
59ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL-7v_oDEIC9jf0DGM7N0vkBMAE&v=APEucNXDNRRQ6WbHK_lh7SSFnpJTW6_-b250_6R1j7hgKie9ZfN61vaqw-cpJgkQVQPHztgiCowS6HWyGNle35fb6yU8A69-xg
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FOojdIqdP6f32QVts3wtohNRzO6SQFuthHPjRGgIINb69H%2BezXtS7jCJ%2FSx7TGPYrYBsAC50Fz9d7sEuhQZTAqnLLt3fn8ufJGZJVh4bGmsHs2wP7bnlf%2B25rO96cpTesxynKMKCb%2BF7zA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 816b8c83be3f5425-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4321
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZSxpvZI3NnEuUUkVRqkpdQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1

43 B
737 B

70ms
62ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL-7v_oDEIC9jf0DGM7N0vkBMAE&v=APEucNXDNRRQ6WbHK_lh7SSFnpJTW6_-b250_6R1j7hgKie9ZfN61vaqw-cpJgkQVQPHztgiCowS6HWyGNle35fb6yU8A69-xg
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sz9xSBx8%2Fg%2BOI7kiS%2F5%2FwbYZqjls6RhpJq7pBmcG2ZFsKfbgiQitIojuDG8G0ooucfMp1BS33nO02%2BiLbydEkyUvG2ZqoZmd3B%2FCRTfPEJpsyFzWzpvlKvZpas7rGCOdbUOqskMC8HC1LA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 816b8c843f075425-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED3d5NLXBj89gwAgar7Jyds&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 4321
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDfKLK3zqhtJ3FmnnZ2_xQU&google_cver=1

43 B
841 B

28ms
24ms

Image
image/gif

68.67.179.155
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDfKLK3zqhtJ3FmnnZ2_xQU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL-7v_oDEIC9jf0DGM7N0vkBMAE&v=APEucNXDNRRQ6WbHK_lh7SSFnpJTW6_-b250_6R1j7hgKie9ZfN61vaqw-cpJgkQVQPHztgiCowS6HWyGNle35fb6yU8A69-xg

Protocol

Server

68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
an-x-request-uuid: 71b7e822-b671-4f12-ae8e-5c142ef7267f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 45.88.190.16; 45.88.190.16; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDfKLK3zqhtJ3FmnnZ2_xQU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4321
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc0NTI4ODcwMTAyNTI1OTA3OQ%3D%3D

170 B
188 B

45ms
41ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc0NTI4ODcwMTAyNTI1OTA3OQ%3D%3D

Requested by

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:49 GMT
an-x-request-uuid: 3a84c560-a37f-4bd9-9e8e-4e2811cdfd79
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc0NTI4ODcwMTAyNTI1OTA3OQ%3D%3D
x-proxy-origin: 45.88.190.16; 45.88.190.16; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame 5105 30 KB
11 KB 31ms
30ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A8tzgadDkizdJFwf6UosjtJIzcGNGUi-PFoyMRHFcI3Chs1bgX9Mcxt21xLvdKKmi_dm1rwcJYzJNOXbvwfSmz_3MtVQ&cry=1&dbm_d=AKAmf-CFL5aZBn1JQpgo2Cy9AZfLHjHtb9T-nx0Wy1AlsirVJlhs9QlgEet1RbIKzv8MVi5esJXOdnViJTHVW1fKEPAq18sdcr1TiTzh5bGua1AMDPKn4Vs6ygTGr7DCSMaB8q0uihF8ELjYwSVXAQTF4jTOyr8tX5kTTmRO5LP1yK6k2InoeJfEGAM6KVPnGy_ENSOcSqabbW683J8DvR9jPuAHEn9H3QHWOH0kIrjsx7vubBxFEjNYnczbIm4UGR9h5otFB--b6trxkkJzX4Q2JR5s_OoC8IfKpgOHZfvkPrG28DinIBcubGm6iwBcPjgOzbdh4_qRilNZyyATRlotfOmTtcG_pDBipFvVqfRBC64At4_QUWxNMR7iE3oTx1CbyJt5mkfiC5WFZPyAY3GBbfRPL_V4_eNL47L-RPXWlWoh5sW6FAZvHxYjt7JywuKaTC4WAV5AsHj2Ze8mEp_XSWnj--u8gNXKru00OWpJoMPbJHlDthR5PU3IH5T_fbWOdfBJaFkWk6BiCwlEkW51KXDv958EYmxJuXvYJRkM__HnMi-O9FRij7qASAq9pyJwkfXCSGwJhXXL6fPeRh1r0wvBd5KLjdUrzS7fsKcoM6jc4pgi0Fkg882Vg7DVFb3xYlf5OX8aojExZ-x5o_XmUncYvB9h_rlEjhr6atxHjYBIpKhqnfqe5fyCBcAHDFzcdfHbgO2HK4TecdTZ-jtbmSSCfDjD9foAycJ7GGYECGu3s2x_Depfm7d2eX-g1bhplloVPwcjdtGoa3nBYWX9UYCibLxQa6Cd8RaHCzBvfAbVTcNKrw-otuIzOJuJGa2AVzlaAHaj6fgf1-hb4iBrhGVzYCoSdWwBOR1RDB1BKW3FmAXa7utVEoBCXk9GEkxZv1LzpfxrvUhPqnJDPxGkoCLzrWo_ntq5f2ct8eUAGOJ-VJQ-JfwaOpbScsE6h1OBlOMjqSFhMI9IbZl5rDlVs2P9OVL0E2nO6gCBI0M36Sjr-7ahPSbw_AFIHnx0CisZuAMN6vH7b85rRMtQJi12gyZeIz0kTwgC1Kh9mO6t_ky4485DdMZn5trxLEGk9o-TX719BZ8j-Sc2b5U9zQTAuj-bmcdPKB0Fg-05A_LgefTbCVbveLMDRl7gyM7--eeW_6EuJ6eWrmC7NgF33nHNb6s9IVmVw2G7Dba4luMIQ0Wc3NjR8ciVyA-lCdunoybAh8GmuqK3WUK2vb3hOzCcJi3TJh8JCcs7jStA9QBbt2lh_RmP87QWSu0di1_lgRaq8YHpVTbpFjvrpsmQ1_GPBVDCJavLiISBWFv2Ck332WNB1qqZAtFlENmcrlnCI-LLSyArTlJTOEWHOQUpHU3FI5TI9sUXUKbpgH2rMCllEKlTiXkn936ICU7Br67C9lYqKchV9C_91BYLJkcN4RSvR87jV8KCniL2JqRFlepXkUcqjvqHdlvIqajT4s94hTEZDxE2zzm4Uz6sGHtwGZXYzZr5LcFm0wwnfquk2-dlYLb7Xsgul-sgDzItltigZPUS6UUFGgdNkzyMyWi8te6xwujJP306Tt_fzToB_LLftlb1o4ZQ7jt5lLVu6Bm-z2agfOBfoKlYi9HAw4b2Cam62x-EKNjF8EFM2tkYoBU2ogbVLUZ0rBrvh2vMR4bbBMDa_M4qBVViaG1x9yj0PNBG77gdNVcYa7QSNqvLGgXr_6xOAH_NV9BvYlXzit1uiTjGp_jIHH_pfPaDZeAtkXjbDAwZURa1zuuHM0KgAENHqQz94qt-luvBMDFlvF1cPYc6VMTveEZLZCqmJZ9EGWw-gEduXATJFM-rS6ctQeOCxFl5mYBS_DoZTqI0kNVQr4sMoPjAAr-JmCsqHuV2EKfigp2Y9Xg-BFuELM1t4zPaJOIrP2N5KZM0sVsk4of6Owy6DpAX5nLW36qsFdtpEJRUUliz6vUvdip01j6UB62A8weBVySRgXDcuyGfx4CEOHY28xcX7iNbQxD1uOlgaIm6UDlPHk750f-PNcEdu-evWSjGLCqwXVkwow4Vw6PusPUTJAK1YXkFo5YoVPkVO7KN5Qv9b1bZRGJqThi30PJfcAaoiahKMjdunx-83VxDFwl5u8MI88YW0OkABskD1FoQ2xOSbSXqgNco9iD0tpKLn0erEvI1mGgCBACVPHEUPj6sHULKUb1LA80fyKiNDoZLeBesBDLXmbGnGHoWlZIga_TF2aAQ0LZNPPg9ILbQwcZ4uzOQ6EgK8AvMvi6M4-jOwGhFgjGdcLLUwfUJNWoa1HmGpTv1V1cQgp2MYaBnNClU7K1laq05f8bc4dUIrrf1cbTP9yvzI8VyEOE9Rs4-KUMtfhKuXZYBvoRwjHBeQ36QX8Z3XNmCjLSAz8uER_CGNMLBmnrPNeP31LeuTFw_BdyJV7u93VkQHZkx7-s6JPDlpoyQJjFyU0kS3BKMBe4ZixRVyAqToSzuoRFK85yHHJ_1G179kwe8-xII3S8kcaV-2-GHK6wogtG4H15_lM71-aXNFcAg6NKLyXzuLHHQfNKgt2Kdo2MlKOHWw-WmTcac0Tp4DwO87Ozifd8bHtFs8RcXl85fWgOVt76aNV4CeTVo8QCQKVCF_zQqDBTi_Q2yvzvSPMohCVB5IiwngKDQATDAwvCnIli5mx4SiEX2GH0hkWjydY44VEI9cJYkEFJ-gzLCNBtBcOe-RQIrlJpOqZd-OGdbjM8oKdtLdgD8gwd5vzkkoVR-6SlUVZD_T6Y1gi-bcXLgtSTbDEfWcQe-d5k9tMbEf4RuVQ_3QAyyNy32OPeB-i6GD78qmgu-fNly7ZPUKnrFyF4tMg1aCYGIblkztzNLmUKWuf409Jb4ce_aQcNxOpAnz8Wm6ACnW4Fy4OF00SACLEKGTNILIfRlqRXJhowKIm-SSClnQFeDRlxDbOhN85DbNHeJVhruRBOhPs2g9D-EVnCERzeV4G6tETNOLiD_MQT4SPP48yVEZGIMEYHJGYaZ_9hzIPrXfHpwdbTpJmDJO-L1El_cinmhwSGeVE_-EQAw0SX4TyiGJNJRU4nHMxr5ZpvxDOElwm8BM-T_UGqDN5B368q4H7TXtH1lUCSlML-lNBj7CZAFJECz35qex19vgeekFG5ow11jLjdTgN4LxY4bBKn1w9tr4nhl7Y30d9LdNWsZy_PMWeALVHVUqIajgpWKsn0sdwH0xGIaZ6kunncdm8AgkTXwePo_M_TkGP58DQZwyHth3IkWTJGTWem7jwc-mEeVL4BL3q8WmwIGYnx2MRZBJnkMHYa6qbLTx8xfL0k6E2GltO06R8ftOT9Z3jpDuNlmkkMngwkGxk1vhoZQ14m29y7sShf5Vm20UIgY_2tsCGUpTcNa3hYV-pMdWf5MrGyG2cbscG-4d6RrcPpRGXUZwvA7_lfI40srLzDY2r29U_U77EPMgkkj7SQ&cid=CAQSTADICaaNHj8gfIVYSehToKRJpZzdBiumUE-pklVKTqxK_wprN2OGbhKJTCR8WsWl-6wysaMI98RX4vh9ByDG1izHcs2V_LssW-xjdfMYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffontesk.com%2F&ds=l&xdt=1&iif=1&cor=15033693941344100000&adk=1726166460&idt=97&cac=0&dtd=36

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

c75166534a7cf375f7963558a6a55858688f6c289c9d200706ce1592669ffe3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 05:55:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60153
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11596
x-xss-protection: 0
server: cafe
etag: 6499730840814102677
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 05:55:16 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/ Frame 5105 11 KB
4 KB 32ms
30ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 00:05:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81163
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 00:05:06 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5105 0
0 134ms
57ms Fetch
image/gif 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst2U20xqDsX7Xnno2PuLrWHEjwlfKYRqSem6Jq8cTjnAxO_XeS8WzvzYSValDq3yDTotjhm84fqmr9AuB1IU5MkkZT_GbP1qrVTg00bQVqggI2P26i75CoccutGS8pPkoVRKF-NIUco3OydCfvZkh0sDqREiV7D6RlaPh0fCiQx5SVWpyx81IVjJReW3qi5PYeo4y4u1d6Up6jtoIuZVtHTi-XGnnwNXqW8L18os1WPS-Rdi1ZDqtDIdw4myfBL5yktDK_DtF_cWtUOfUntu-6iQgj0lSur0nwr3cfsucsr8JDsnNcj_vbScrYL4dEcEvwj8FqLgzcLQZ611Q-5FAEvDE4j76pSVroDyTrk68JVKjIq3Hx6aT3_sk_I0OKEKCuPvTKfwHHz-8Oq3Y5Xl0OZQsfVTM_KtKmz2xNETn5nX4zaAVT9TyXbxvbSAmidJ8ffMUbuIpx1cBpTm2ozQ8MQ_p3ikoyEacpgDJTYV-AsLUgqK5QhtHOjZZQB5fDZT-V6BKpn0OG3GB_nJHyIyXIqxbbslR_-_trFDPh2Z_Jiz_XADwGbKLvqPdG6x6CaTCt0KkEKQuOPZ8kKJdennND2syfafIHtwLO_fJOWVlZLoc0KEEm2hBHEXPqQAOMn2up9Y6TJfjMIRQCUZ8Jucy3L_m44ZGC61ASTAYVST00zLMYv4UTc3TmayTlqcuLDJ_hJwMUXEeVXiFMiSz9OmtybqOAQKePcN-XAkyt1dQ20i2ftuzwq53uGIyPDqQp5d1Lk2R_SilhwQKhfxqDmtJ_2F_g5UAS651ZgPsF3ZJbm4Wxzqtjp21kbYC_bZUI4aBg7N-04kFVzzA4kIDtaEoXSAeKiX1U-z3jofeUnoyXy6ijFUBK1CmBuI_EVYNRBS2xzXsRc6DUCW2wqSRwt15dAzq6vNUYevRQqXI4gdL_QKXojZ2ock18j5AvkTzLYJQPfmujfXgkFWiLd0z9_jGHL0HKesEmSrmhd3Xz0aOqZfz0z8vKu9YuHZ-IKtaYRZVuFL3joN1cSbYt9j3poq58HPSwPisSCFAEBGP_a3hQysKKGptCgzVGT7D-sLRwsQCpACiX27IK9YPrsPPpcjjc4Qna7GueU5yTVigwje6fJPNn70SQwuuReQ9K2ozWCkZKHr4BPVTDbAh3RGkHLOoLx8YMrmecmwVGXCTKdoeZMqlZINkwf26BzKl4QqdWuis18g3BEkh499pYBwuvykpiuvUvsuwXBUplzKd6OAAMTRmwsMWmMYeuZdI5ZSd4PHqYMs6QoHVzyJGBSa_diQux3Erip8aI1ymt4T6suaKE_sQ&sai=AMfl-YSO_5xqWO5rs6zFGTLEKNDFaIBN1rm0bz6SbgRdq_uiVWYn2rR5RAZyv4FwwH6h_ZwMXJuRrbP1-sOkrmKLe9KgepVQPp-FCvSobwf_U5BcwCSvUTYByu00ZUsvTLFQhRkkrd3bmjQnlZlyqWANdPlzuTDzxQucdR4to6VIjao-S6vJLHWh0mRYjnHi8aXG_itkMid0Uw5vYlmNebRy7QYlbkFQNBKkefsYk8gKGiYNWldtevkrt1Elckt6qvTd_lo2_XNVOs-bntfhimxahlh7QvCep3AtljUv&sig=Cg0ArKJSzCoIt_hscIG2EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20231011.64567&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 5105 41 KB
14 KB 35ms
31ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:15:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 274941
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:15:28 GMT

GET
H2 200 10645979501938594380
s0.2mdn.net/simgad/ Frame 5105 63 KB
64 KB 114ms
33ms Image
image/png 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10645979501938594380

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

bb183010759f5683162a5dde5e737ca6aa9d34f8b1b862bf18343b858d811190

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:54:02 GMT
x-content-type-options: nosniff
age: 204228
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64887
x-xss-protection: 0
last-modified: Fri, 09 Jun 2023 04:12:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 12 Oct 2024 13:54:02 GMT

GET
DATA 200
OK truncated
/ Frame 5105 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3d657ec1e1cad2825dba037cd4bcf80aecc08d3978f3c0de6e22d326ddbd14f3

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 63FF 0
20 B 45ms
44ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=706260665766&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 63FF 0
20 B 63ms
62ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=706260665766&version=m202309260101&ct=76&x=1&cor=1471633618171313400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 63FF 90 KB
38 KB 78ms
75ms Script
text/javascript 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CbkS0FcWFN6JWziNE8kUVz8sg4nlJqhE7cjw5VI0tg77efMsLLlmcCRdLOH3wJJr2WGik_C_LUe-vJgK86DKgN_LWYnQ&cry=1&dbm_d=AKAmf-BfBmX9SQP04POC597kXK2ko2AfICWiqSXLm1H-JN0fTHk5Bq0D-1fiO9Jt-5rwaqB44HI2walqfyT4ADbM7yuC2zaGOZDY744AND57Jvtu0bma9TlJo4E2d7f8mQcZ22CXpB9T-EHGXrlPBNo3anhPs6Jlp_uE38bRVlI_cMl99mXfMFSPOJyjIliXWMixG72LoIV05OsLSo5RPoMDsYs3IxMIjqvg0iitvIdSRAjInFZ2dWAbZCtSVFIyCqXB_dpnrfKYkgSnJM6LH9eHPpU53xb5LJ04WY2ShmORJHKosv358FzdGGBeUELxJGFwkVIaSrhZ44BHguiB207YFlD11SBRLszY51dnJJJGTA1C9WIIvgEu4e9ZRklgWHu73uC6e-cXYgHgxZIWeFrcSVrXfwYJ1zRp4sYSd7jVW1Bz4hnks8Fs1hC1mQ12INVtlzcm3pv6og6GgW0Udq9R82ErwtiE01jmSl1u62UoVFr8k89BGMAe5WyokV9dQI3i4ArGMI8a9ZRGNIzt86XpJ3n0kIgNDhi8JB7N-FcbSC8WzQGyQNX36ZQBSzLFaJPfOtRX5I0kPXMgQKP-8rw5jGx234z2DIl_LIc7lMvSl6xzN-Lz4-Y9JhBHdu7B05FLbIRQinq-md4XMrtfpBfmX1X51eHzX-5jmmLrGgNxf0g9Hys--x-uyvV4_ufPln4IQajFva5eqjTASfxBwEFDFg4J9YfmMLxyRSYEm4ZZaJqiuJ4DYEvG6lzjo1MeFAaWwU0Na7xnu_2IPCxrsp36eMNwqa7szQwm7dqBOkoTQ-iSHR3RB1B5sqlRHIQA1aH0h6SBi9fg4t2Cg_J3tgtSNvA2_ScUMiChDLPFbu0fwm7mrJWmqTzXL1tKOErZraded8XvPuNx7xbVACqOO7hoDDBRdvVYxUh7aeuCMGrvruO1Kq3-SMXbNfBtA-4dbbAs60eByffdn7-xh6moycA-066Jf1jnHYoxpYJ9ooNjsZdReglznljo8PU8MbHL6-YkUjGxNKwYHH_5TRQ0-I9yr328CAP2Ik9AYmwGxAVwq5YwalwqwsuVPflHZS0Ii1ypgizmiYlzLEmrANdx5KfMuZp8TS9un2IeHyt3ujgMNnFV0QqhXCZoLoDD_C7XBfqPSQzWgbOCTeLiE9c_hLbyCZ0RsQiHtH4RaevXjJ9KiHB9Hm6oJ6x6WDkY0Q9_q9cmwy113QpX09sYljgPoBkN_TColy9E1k6pqRGE2V_rj7Zez2AEeV232ZxtH8AZYlGNGEtetLG5Z0MwWg8LDZSWgYSFJiEPD9gO7oQ7_Ug3g63lLylAa7Q7R3RBY9CTLtJMNwXAxRq8Svdd-js3JKOM1_ZvJDDxUy-0CoCZDl_ol4RQk86BrGnCuYovOhUia06-ds0eg6LapPrn5nPXEqTS2fQlKfbFTyRhbcTVKhm9YnY1MMZPJB0eI1I1aGZT8HMW7JBfgqZU-ZRiThcF0MbVV8DCW8zgljp1BnJ7m0pDfwm_pwNxzX80fM1S8ipc3CfKR4-4pIx2GwrEn9XGpDCjcVUVUrcYWrxaSmOQg-_wQ-irEwsY5INDtnF6hJ3CM3iLV7gnuh29HNXlveusyOL-BgpxM-Ca9naPB6MOKWKTKT9GHTx4qvpaa-oFSl-qpxYq4nHsN85Ekju9G2WEvYHfwQ_61Zmqp0Q2SXvN4FBzRp5TVwMX7bJLNkaz4FsP8DKfZTez_nFMNfMr-4T68YmVAvQaGvs-r9zAbLwwzR92kEZMQvzVAKbuMcpjQSN3tVzgpH9Zt5jdNgfPeLfdLrgbTbeGar5g2lBguL1tto-EBrc5VZoJuO6i_gx5R3Cj3JAh0D46_zl6S-7AZGGEJZb65jdgp7jKlZh33rW2AjNKEKwnh33hbsJ4_ywcjSyhut1Ne0ly3MHCeL0hRSA4BUjuvP61o1FR_kQyXd28fCCxOne8gWL138x9ogctVe-3QhkyFpq8ZJSPi0vDa-J51PzKhRrOxR2okf35eAg2Rlw2mPq732UXIhxfg9JXeMh5B17N93VDzXA3pIwpq6x6N_fKUw1CVyB6UmiaYvovQx5MqneOLjB512tJYY-DW4KM7qNr3ji1OuXgaoCwCb5k2RhJjL0_sGtafFXAlRO7E-8xN-g23mq0-SWvVNL2r6jRQTpbqfrSxRw6EGG3ZEMIWT1l1Ax0owsoPk_4EWAHqsser5jL1e79RVjFiHourbYQ9czusaC8fROKqOkkGXZLtTtLpscciKNBLJ_AVPRCVVCdV0lq-2W8BOJC3gWj6lQETKfk0AgLhmNohSOMGmGxnWBHGs_mzpnbt0w0AxPRCVvjwv7o_ZSB0C7X9l2JHA6vqlvqzMDUBU44DI36QQh3hHWxN6rbqHJS6RCNvZHv_Iv9fOZr5B0F8Reb-IRZShThGngpa7FB--c78YAD1QwmB47x0wujV_eTFEJU1VynKRSW64As3kMbQiN9PJkLJshN6QTEt2dqTgD51dhqK2atx45VMk4AEm7J0_xJSG3kL1-ORNrlFJ9UzbGY9MdmUKMiZ1w9IO1WhNUsMtZvoX4t3Sku9eUUVJfPILbQIQ-UTn3LQYf_SGI9_GzKKvwzTbForW1F5mKriul8Oso_LTEKqKqz5HkmX9E2du3BOIbpQhrILLhJIrZNkTuAh7VgWA-HVskSq4z-raaFPetpZAC--FUysnU4Y9B4BkG2rV7IAQF-5vwDGug2FEaRxrtEMhejhfKNAp0p-4oPvtwJajaDJqxY72mM7t_NQQU814vwWaVqeFm--8_GtnorTRjeW7wk0OZ_zqsN9OsZQYfWpnDCWDFdo2S_K7-vGUz1NbXV3Ce55RzsH2e25VXhj8du_kedBoBgY01RsIhDXRq0fPlpB_W2yKwBhcr1MLxGnc8XrUzaJaIHw60s2sAj0loTm8Dd1-a0YbJYXQY0k_gefzdeNycWzAde0lGHZuHPYtzoNIaZcomgPvxVD0HUIy4nonw0gIlwSUvotXwAFY_6lrjJ0Xbqgh8y57XP9yHg73gUSDaYeNReeeI9ZpID2DbLRPBz1UQQXFTxLYWMgCB8fL24Etnv1KWzcdvO6rOCtuHNEwkk9T6X7v0Bd8eft9VZqpInX3hvXSOiq4QY6C39Av1Zyq-H9qN4z6GnD_DtKLJexPvAZXqsTNRWd8cra80uZexLx9eLhs22d20g6Lw9PkCpSByeENcKkCChORRPfqW355LaZjcMFAD9-79je7pYKjEmvWHbFsLPEE1dRWtTaC4KDagDa160pKJHcoAM7dqjVDEJb-pkthwe9jZYVetVZclHua9Sm8MEImVEoITHEjG3CRZP9hzHjlioQ8M5Q_JSPrCDquPmLh-XECCc9dXoUeZDK-v_BOh5inIoU13z8_MkAfyZxpgOe-PlcrcjVQV2JCyfN_NePIvraQN4isGkhitc74Azb_9prHDsQLS6CkqcSzMDX0XAA58oLKT8JpKY4DkZiBC21kC6W_Wopig2OIhdVrPG912J-Xw5af8KpB9D6YHqbYE5le0bTjtIUKBBRcLIECmGTGfG53gIS4GwUJbnqJ60LvXC6NDO2vC45vw0vllLSqDKennbg2OCjyeUNySVEWsy5Xsvx1_6Oq-h7LvLJIQvFJCCNjGpwGI8lU6BPuVryPvoDGoP1w&cid=CAQSTADICaaNH-MFU4TFQU8CT7yaiNMSxDHbGI-07vdaP7mJu4GoojcI4z6jaRtMTHMUhxr0_epc6oOhcCg30scWKPpnu4KNmhajzyaxZLEYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffontesk.com%2F&ds=l&xdt=1&iif=1&cor=1471633618171313400&adk=497053795&idt=69&cac=0&dtd=17

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

6d4d45741f0c95f5bde69da00795701b901568998bb079c28a7f90034fcc3486

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=1389527199&adk=3956400729&adf=2752187097&pi=t.ma~as.1389527199&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468757&bpp=1&bdt=375&idt=294&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x90&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=799&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CovEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=r7Kdp7j61o&p=https%3A//fontesk.com&dtd=305
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38382
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10645979501938594380
s0.2mdn.net/simgad/ Frame 5944 63 KB
63 KB 41ms
31ms Image
image/png 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10645979501938594380

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BvI1Lx4qwtpU9nVnWwQIwc64i3PMbvkf6gmcJzUvDs1u44lec21MZ-TYediC6UxiN4j8lT9TGZMbpw1oJjZypHCbSbTw&cry=1&dbm_d=AKAmf-AN_Y5lfjlWGxplqe40_IqALXfXBNVijLNKcs2kR9g53TX9AMOONtlprkabkhbwqol-t3Dry_1T71EzQd-fU7v7ymQuNf4YZB2BCACtd5sJeAKWZ-W4dea2rKlBswUgcbrMiwfHP0iiRKkODMVLxRL3q44dYqsY25txaOYPPNK0h-3_vL0KTW2FsEiJw27SGodj837U1JF66eUoS5Md8J3mkJK4PuJtXZsCu3l_ngQAXQbYcbnDtg6QBKx34lgHofMzVECwx3Et3rjEYZ8WkOFmbV0c7wKUbi7LJxsNvZRJKJkPH_JycGJNkB1CQdhlzhfqRHafgTVrXBh2vYke3b1TvzEA19EHwDdqyJQ21QX237zmuFE2ZYY27A250qpu4NCA1P1w6WogM-loE7SNp5sxTwuKkL5xLAAKMNytyTANSUssY9HpgEvApWZZ6VL78elhpU7OzPtxmzWd6LAijRcSZqqER0O46t6djkacfGAvURbdTwe8hpi38iqeUx_5kfsMGK6omxzjalWpXcbexee1BO_GJ8ZmLlP--lLE2aYBB011ZtDeTKy8BJnz9wLqYqS-ISu3MrlYNfabWe2KzpQYpLBmY515h2-4NZ3FoWbaNCB7AylcKgWV8hJa_4kSBeeBT_XV6oVu3vpbz1fHFsJT4DNl8rZZz1P_93fq972aFVtIuOqR-Oml7vA_JrwGypz1aPWAcHsdQodJKevaQ_xUqmGs9HvJAn3dZtiHtj0dvK65Yj1gkKp-vxU8wzxypAj5ypnhgyNdRVqBXMKEPUpjkyw0MUH9XU6ub4Qv4DZapMd39afnx63sOvzr85Dr4mGNufTXcVv53xiW1mqREbaobpM08tyARIABGSRyB6ahVrfpFfEbO98hP0dCDOotzXjrG1j2TxiRct7e-nfv6Pl5RrRkhTO08dWjn6rArZUUE6bF906mMXLA-s8pQPKVj46bvs4iOxZcqFyCRakrqrxuQMHtOkl63kkFvVpmzynhNHIsP0PcOK9HY4xOiHEHPMQQ877TNqxJWQOxJMBIZiDcT0uVHKYmIIGpERAIenKwxs2d_9o1WebcMAfSt7Fy5w-W2DOXhgJrNyxTsrAw3kryEuqy-4mEohr41U6vq9eMF6WDnbqut3V90wSIGNAs6rDyM8YFlaQF4FjP7cPpD-D9Lv_Q_Okkck9R2eq1EDO0n6EijBcotoBd0QO0om7NKsbKTm4vksVK8dW8FN5zEcnM8DP3Axi1DXeW0q9v1XAWGbRRk1VUYOqDjf3KwsE_DEgEezZ9NIwwrEQ0pt5-DLhvcxty5FCVy8pskXJm6Ho_eZ9us4i8WFs9TFpngpHVZ72xrpX9TbISF8mTYY1xOyQLKSHX92QczBNK8HhUPklTZbrSW3JiOy3QCd5924U6Z3Waq09JOyjfSvhUXEQ-E6JZ4Onz9zGZ06afiZKo6Kp1X_MnL-H9xjdQhvmTqb0PAH4_oQEp8bwTmiKnF2BMonhOturPPwArCWHWJiHhXS_sTvZA7hzNjjmKkQ-9vLek6_68qO94tDvRh949nAjBInBwvKNa9TVnyYVdmnq42OPl_zQTGaJ8OHK6vhYrUITQ9SX7KTYhSYPHz_Im_HH1n1t0dFOZ-CTbLAdUFIUyqig7nlDXD0wTZHaSmg9u9f74ZEbcS774ldSqcKzxivxuwcwsafsbhPuZM0HcxvX_sZ0jKt7Sl7SE1YSY_u8MtD2FNKn9qeS4lLINbEuIe2DuUakjl-7Aa1nEkSpd1X0GAB80S7znLuEFd9hSetVwYaSn7VGdwGLSY1D6HI989mABSnhf_ZVYrTo1tbS5Wl-luWOnYI-T9_wxLaZ2kUUZTgsUYPtIKbNTc-y1QUtGI_E3gkm5CawdawChhiCP0MQ7CoUVpXPx2us3QesenzJqZTK6AhGLAxLu2gOOgTZzQlg0DQ7K62mO1B04R4JDl8iJk8PKVKbZcdvxaEMzQ0jYEPceNY65wYFXALM9ouO2SgraEJW1u0UsJMAUyHy4DavoGC8rwtpyhyRB9MS18sTyTZH6y5c88mNvt1YSG6PbreVWa0TEvUwczYLX_Ljfi6Tx75Ol4d3InRj6n7g-l22mO4sankqlV7_RsSvWjc6ZNFZvrqUT_uXXnhfRwHd0Kk27lcCEtg6efph06Xce7RGIYWoq0vjRPU8AfustWtpqOgT21D9xvoyA4fBElce4adZzscRShzHDpZrYT32MwsGFAp9XAJYpbcvLM0BBZOX9cV2IvEGZDb91JdRcpHoDltyPQaEfmPmJoS__jxxyIqlTVDkIHIzXWmjCrmJ-9kXS_xu9ls3nEdEWMveYOkprkItfKDZ-giCjjjNBH4GYfMf3yYtf0redcFObgS-6bOCx11HmJBMpcXxHItVNQuRxz5rumJCRuDKb2qyecSB2626nM-eMiCpHkvdp1y1C9ba3ntxn8QNhdG58AHpKaXQWMARgrCpu6TKfOcyychuV7YriBHV2gaGZXAW26D4vIlBJcdLNVm0cFDDjFd0dvlAAMfddYNVPV894yG_UfkViwZkyZsB7lefI1B9AjvhMF64kcDR-VxXh60jo4avPOs27pkqUJhvkHWvZf1F33slkxWRjeP5m1TxoHsYuq-R2YwH32jR5Ox_blMCbjwu4U1bWCFoE3olx9M1BE2zyM081LZSwbO_JNqBQvmJl2Gez2Nxyws-nWAerL7a9mWkuLZijCceoVHBQzj-1OyJkVGMU1U-cpvNN_JsIuFLSpmhR3Kbczdu3J_XZsT1NxnFeBdqI6ti1SBAqDGe8Qv-0IDcTZf5xlscOk31crwKySDHxKP2jAmTgByO5dU2zNzIAouyJyZLozuEm62CIF9c8ajTcUBqn8eIadlm9nsUWZOZI3M1_w7e2ZAO7bg7eCuL32MHE2GlP9CH6dfnGG188kmcEmuboA4OZWit1-qQ-RujeE-c5fe2P8eb-yrg4gVnBi468xascVsMMKw9Cg60PtzDV_L7kxAIXFb_wjGNAfvA90hZONYHZ-AlVPbDbvH2M2abC6Tvlv_5P92wizKya7c4zP6xFtGkXJDeSgZ6Tz5Fo_R8ivwquLJdk3XrrvEgzw3eFIu9KbtL1VZiKRT3s9-jNH4ud0H2OiZP9BShv757I3LBhgPq-DAQxX1AJFdR24PU9DbvYv6Zc-POjzwsTcicI0br2kynId3DuUJcwSImt5A78JJDvtdD64ywjxPbaZkeBXlPcb-FyKE4dUap6SvIqQDEeb7YmXLLuR70x_7Lur_sQ2-4pw0YKG68uKka8Zytq6qrrZAywyO60-qK8EqKPaTeciG2XNnxONK4xpBsTHp9P5dihOoJTV9JOlkwiAGKrDAdlOJnZs9bUZWdVulaHpNBHetcook86UxcTsp9Lvd0ic57HjxbHLlu6-7gQIYhtFTBT69U7sK0XkFZd19J8ri0s005Pa-hRchll&cid=CAQSSwDICaaNu4D-lAmkL5E-3cdY77Eo3BH3gXoCrsir1RBZYX8MCdX6YFBV37GSJtuGa0rwrrRkbQXzsgJjN4Z7vamTA1_ThbelsQA59RgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffontesk.com%2F&ds=l&xdt=1&iif=1&cor=17534240720175229000&adk=1761367587&idt=80&cac=0&dtd=3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

bb183010759f5683162a5dde5e737ca6aa9d34f8b1b862bf18343b858d811190

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:54:02 GMT
x-content-type-options: nosniff
age: 204228
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64887
x-xss-protection: 0
last-modified: Fri, 09 Jun 2023 04:12:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 12 Oct 2024 13:54:02 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame 5944 30 KB
11 KB 38ms
30ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

c75166534a7cf375f7963558a6a55858688f6c289c9d200706ce1592669ffe3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 05:55:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60154
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11596
x-xss-protection: 0
server: cafe
etag: 6499730840814102677
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 05:55:16 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/ Frame 5944 11 KB
4 KB 40ms
32ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 00:05:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81164
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 00:05:06 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5944 0
0 60ms
57ms Fetch
image/gif 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvMQmYChwYlNp1i4CeOks6I4w8zjhmKpyraP_VYwnOklfYwoSxBrqne5BCCRlFI-jn12n2apWsniajcpb1bhxwDNgdHg1LfP4bcN5l91nb2aGhOrlpkfwEkEhR6h2BErKihqHiKSOmqbvXWH45gF4mDo0i_CARypXQdvPP6xI1CyvD_B9U4pBqatIGYWB6OWotOrxpRxlh-KTYh1Mx1QVILZQ7xEt-FS68Otea4ncjSX_9KspKU65vBBBd-wsF4z_A6_rFz_x0jWbhO_wp1zCrqUTGfk3Q4s3ykQV4yzAkba5YXD_QE8urnMKpdozK0GwRg1RGHa0i9PIhQqylsKxtQXZBVbELdH5j15rQ69HxwvaGQY4gYhQv3bxD2DyrHuW1HTdyL4bvlpvXBDlypLBKUcc7ZE849exMSe8KazaTeKkqyJgTjxk56XuaPBj21SG2Gy9vbTNPcPIRCWjv4L5-M-hgemFYLAZLsl5CQISnlcmFcHWRdh1BnUQjagHjW0x1SHnP6P7tX-B5kMhLAzBX9iK7Qdi9TtjaeIdeX0kGh6BshZcFDC9MgrWNZJg_XN0T1aXrC5ei2buBRe38X6htuzjfvQECX38iHZzuskaMMjjyobmZaZScE6nRPdopVYpicMTUrRELAg9_MIwGgdJ3-YpX-dAyIXKxOFFIHsCHLvcnf_blVyCwBS3PvW_mjYyjN1DpHgZd25xrNMt2UwJGpWCzyV3Sw6SR8CyYwK-Pbvx9IaSxsfw8jvyZPyqFwALmSm171Wo3M7hnwhPTQPgxHSUzhOPP2oAICRQs_W0gU3VSPoJhgvBaYWLxzVzhawJw1A3ndZYxmEdp49A6dvvWIddsHGj_5NOe4IWhE4S88t04Q03rYj07EpEJS5U0gW0Y0bW9cq6TChK3C8gAT2A2fXVyj-TpA2pCm_xUGZZN46iu1w7oEIaFxa9aZiQXU0gRN7BmmhqsET4y5W0yIQfO-lUqAKteRoiQco6MavblJ_tVRsxJWJB3NoCXnd1rTP4OFrywEbbqdYKe-2V5-qQVZ053PCNlXCgWpDENKL7Iy9jFYA_7-AmaQyE2Fsn6Ebyo3pSsx9_fV5an3rTkfmsEreU3My9mamix7R7idWeMSM71tK3vQvoD0hMt2ipjy0ssyEDVDBJVTYhgm7DGXewphZSI5mkADPHotA4dMwojb84awCCngoqtisIDCznwCzX0D1yXjWnroIvvWC0WGNyHexJ9SIM_ZPTE4YjEaxCmBNJKdU01fzkJclq_ZF2U9yER3gLkVTFFVi7vdjp-pBwZGwyg3_3taV1-RqGE1ndwYgUJeYo36t2k&sai=AMfl-YQyEAYqV4dNoRmg-0Hxhvz6XdSrw6o_NitJq3-Y4UqdLYQWUQ1D2IFrIYjKctHOVEOD7Bmj_68OOnS1avhUPz6MAzgvtEOwEneasCbrgtUSQ-l8WI45cj9iob71y2wUkegVg_hYpt_9wcdesEdNCVpi5L6Fr2uqhAIjGMtlLUUXsyrhEA63ntvBmwSGPybGFIhm9J6IL8myyF_SQHiPdsLbGYvigbdkRCkSV_vKalXuUITNfChCnoUKBmNlVj8u7MbC8B3qpuorS_sRAX4uTfQOFqKD5JSt&sig=Cg0ArKJSzN1m5lWseZiwEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20231011.15856&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 5944 41 KB
13 KB 34ms
32ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:10:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275242
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:10:28 GMT

GET
DATA 200
OK truncated
/ Frame 5944 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9adc7199c788b4fa2a30f6c8f79066b81300547c3d626d26cf825ad6e1635cfe

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5105 0
0 48ms
47ms Fetch
image/gif 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst2U20xqDsX7Xnno2PuLrWHEjwlfKYRqSem6Jq8cTjnAxO_XeS8WzvzYSValDq3yDTotjhm84fqmr9AuB1IU5MkkZT_GbP1qrVTg00bQVqggI2P26i75CoccutGS8pPkoVRKF-NIUco3OydCfvZkh0sDqREiV7D6RlaPh0fCiQx5SVWpyx81IVjJReW3qi5PYeo4y4u1d6Up6jtoIuZVtHTi-XGnnwNXqW8L18os1WPS-Rdi1ZDqtDIdw4myfBL5yktDK_DtF_cWtUOfUntu-6iQgj0lSur0nwr3cfsucsr8JDsnNcj_vbScrYL4dEcEvwj8FqLgzcLQZ611Q-5FAEvDE4j76pSVroDyTrk68JVKjIq3Hx6aT3_sk_I0OKEKCuPvTKfwHHz-8Oq3Y5Xl0OZQsfVTM_KtKmz2xNETn5nX4zaAVT9TyXbxvbSAmidJ8ffMUbuIpx1cBpTm2ozQ8MQ_p3ikoyEacpgDJTYV-AsLUgqK5QhtHOjZZQB5fDZT-V6BKpn0OG3GB_nJHyIyXIqxbbslR_-_trFDPh2Z_Jiz_XADwGbKLvqPdG6x6CaTCt0KkEKQuOPZ8kKJdennND2syfafIHtwLO_fJOWVlZLoc0KEEm2hBHEXPqQAOMn2up9Y6TJfjMIRQCUZ8Jucy3L_m44ZGC61ASTAYVST00zLMYv4UTc3TmayTlqcuLDJ_hJwMUXEeVXiFMiSz9OmtybqOAQKePcN-XAkyt1dQ20i2ftuzwq53uGIyPDqQp5d1Lk2R_SilhwQKhfxqDmtJ_2F_g5UAS651ZgPsF3ZJbm4Wxzqtjp21kbYC_bZUI4aBg7N-04kFVzzA4kIDtaEoXSAeKiX1U-z3jofeUnoyXy6ijFUBK1CmBuI_EVYNRBS2xzXsRc6DUCW2wqSRwt15dAzq6vNUYevRQqXI4gdL_QKXojZ2ock18j5AvkTzLYJQPfmujfXgkFWiLd0z9_jGHL0HKesEmSrmhd3Xz0aOqZfz0z8vKu9YuHZ-IKtaYRZVuFL3joN1cSbYt9j3poq58HPSwPisSCFAEBGP_a3hQysKKGptCgzVGT7D-sLRwsQCpACiX27IK9YPrsPPpcjjc4Qna7GueU5yTVigwje6fJPNn70SQwuuReQ9K2ozWCkZKHr4BPVTDbAh3RGkHLOoLx8YMrmecmwVGXCTKdoeZMqlZINkwf26BzKl4QqdWuis18g3BEkh499pYBwuvykpiuvUvsuwXBUplzKd6OAAMTRmwsMWmMYeuZdI5ZSd4PHqYMs6QoHVzyJGBSa_diQux3Erip8aI1ymt4T6suaKE_sQ&sai=AMfl-YSO_5xqWO5rs6zFGTLEKNDFaIBN1rm0bz6SbgRdq_uiVWYn2rR5RAZyv4FwwH6h_ZwMXJuRrbP1-sOkrmKLe9KgepVQPp-FCvSobwf_U5BcwCSvUTYByu00ZUsvTLFQhRkkrd3bmjQnlZlyqWANdPlzuTDzxQucdR4to6VIjao-S6vJLHWh0mRYjnHi8aXG_itkMid0Uw5vYlmNebRy7QYlbkFQNBKkefsYk8gKGiYNWldtevkrt1Elckt6qvTd_lo2_XNVOs-bntfhimxahlh7QvCep3AtljUv&sig=Cg0ArKJSzCoIt_hscIG2EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=248&vt=11&dtpt=246&dett=2&cstd=0&cisv=r20231011.64567&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/ 157 KB
53 KB 57ms
57ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

0f9d27037405494787cd35a5742b2dd2ce06f72ffd110dcdc48148388ed2571a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54685
x-xss-protection: 0
server: cafe
etag: 8390448300964038728
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:50 GMT

GET
H2 200 ca-pub-5952306940031097 Show response
fundingchoicesmessages.google.com/i/ 158 KB
52 KB 136ms
63ms Script
application/javascript 172.253.115.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-5952306940031097?ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

d1c596d958d64e0145a006c24702e41cd888149eb25c290de827e211b3043742

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-RxVtw3Lc-mqlqsHJaCo-Yg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-security-policy: script-src 'report-sample' 'nonce-RxVtw3Lc-mqlqsHJaCo-Yg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5944 0
0 52ms
52ms Fetch
image/gif 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvMQmYChwYlNp1i4CeOks6I4w8zjhmKpyraP_VYwnOklfYwoSxBrqne5BCCRlFI-jn12n2apWsniajcpb1bhxwDNgdHg1LfP4bcN5l91nb2aGhOrlpkfwEkEhR6h2BErKihqHiKSOmqbvXWH45gF4mDo0i_CARypXQdvPP6xI1CyvD_B9U4pBqatIGYWB6OWotOrxpRxlh-KTYh1Mx1QVILZQ7xEt-FS68Otea4ncjSX_9KspKU65vBBBd-wsF4z_A6_rFz_x0jWbhO_wp1zCrqUTGfk3Q4s3ykQV4yzAkba5YXD_QE8urnMKpdozK0GwRg1RGHa0i9PIhQqylsKxtQXZBVbELdH5j15rQ69HxwvaGQY4gYhQv3bxD2DyrHuW1HTdyL4bvlpvXBDlypLBKUcc7ZE849exMSe8KazaTeKkqyJgTjxk56XuaPBj21SG2Gy9vbTNPcPIRCWjv4L5-M-hgemFYLAZLsl5CQISnlcmFcHWRdh1BnUQjagHjW0x1SHnP6P7tX-B5kMhLAzBX9iK7Qdi9TtjaeIdeX0kGh6BshZcFDC9MgrWNZJg_XN0T1aXrC5ei2buBRe38X6htuzjfvQECX38iHZzuskaMMjjyobmZaZScE6nRPdopVYpicMTUrRELAg9_MIwGgdJ3-YpX-dAyIXKxOFFIHsCHLvcnf_blVyCwBS3PvW_mjYyjN1DpHgZd25xrNMt2UwJGpWCzyV3Sw6SR8CyYwK-Pbvx9IaSxsfw8jvyZPyqFwALmSm171Wo3M7hnwhPTQPgxHSUzhOPP2oAICRQs_W0gU3VSPoJhgvBaYWLxzVzhawJw1A3ndZYxmEdp49A6dvvWIddsHGj_5NOe4IWhE4S88t04Q03rYj07EpEJS5U0gW0Y0bW9cq6TChK3C8gAT2A2fXVyj-TpA2pCm_xUGZZN46iu1w7oEIaFxa9aZiQXU0gRN7BmmhqsET4y5W0yIQfO-lUqAKteRoiQco6MavblJ_tVRsxJWJB3NoCXnd1rTP4OFrywEbbqdYKe-2V5-qQVZ053PCNlXCgWpDENKL7Iy9jFYA_7-AmaQyE2Fsn6Ebyo3pSsx9_fV5an3rTkfmsEreU3My9mamix7R7idWeMSM71tK3vQvoD0hMt2ipjy0ssyEDVDBJVTYhgm7DGXewphZSI5mkADPHotA4dMwojb84awCCngoqtisIDCznwCzX0D1yXjWnroIvvWC0WGNyHexJ9SIM_ZPTE4YjEaxCmBNJKdU01fzkJclq_ZF2U9yER3gLkVTFFVi7vdjp-pBwZGwyg3_3taV1-RqGE1ndwYgUJeYo36t2k&sai=AMfl-YQyEAYqV4dNoRmg-0Hxhvz6XdSrw6o_NitJq3-Y4UqdLYQWUQ1D2IFrIYjKctHOVEOD7Bmj_68OOnS1avhUPz6MAzgvtEOwEneasCbrgtUSQ-l8WI45cj9iob71y2wUkegVg_hYpt_9wcdesEdNCVpi5L6Fr2uqhAIjGMtlLUUXsyrhEA63ntvBmwSGPybGFIhm9J6IL8myyF_SQHiPdsLbGYvigbdkRCkSV_vKalXuUITNfChCnoUKBmNlVj8u7MbC8B3qpuorS_sRAX4uTfQOFqKD5JSt&sig=Cg0ArKJSzN1m5lWseZiwEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=119&vt=11&dtpt=117&dett=2&cstd=0&cisv=r20231011.15856&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 63FF 111 KB
39 KB 95ms
30ms Script
text/javascript 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 13:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31754
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 13:48:36 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/ Frame 63FF 11 KB
4 KB 35ms
35ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CbkS0FcWFN6JWziNE8kUVz8sg4nlJqhE7cjw5VI0tg77efMsLLlmcCRdLOH3wJJr2WGik_C_LUe-vJgK86DKgN_LWYnQ&cry=1&dbm_d=AKAmf-BfBmX9SQP04POC597kXK2ko2AfICWiqSXLm1H-JN0fTHk5Bq0D-1fiO9Jt-5rwaqB44HI2walqfyT4ADbM7yuC2zaGOZDY744AND57Jvtu0bma9TlJo4E2d7f8mQcZ22CXpB9T-EHGXrlPBNo3anhPs6Jlp_uE38bRVlI_cMl99mXfMFSPOJyjIliXWMixG72LoIV05OsLSo5RPoMDsYs3IxMIjqvg0iitvIdSRAjInFZ2dWAbZCtSVFIyCqXB_dpnrfKYkgSnJM6LH9eHPpU53xb5LJ04WY2ShmORJHKosv358FzdGGBeUELxJGFwkVIaSrhZ44BHguiB207YFlD11SBRLszY51dnJJJGTA1C9WIIvgEu4e9ZRklgWHu73uC6e-cXYgHgxZIWeFrcSVrXfwYJ1zRp4sYSd7jVW1Bz4hnks8Fs1hC1mQ12INVtlzcm3pv6og6GgW0Udq9R82ErwtiE01jmSl1u62UoVFr8k89BGMAe5WyokV9dQI3i4ArGMI8a9ZRGNIzt86XpJ3n0kIgNDhi8JB7N-FcbSC8WzQGyQNX36ZQBSzLFaJPfOtRX5I0kPXMgQKP-8rw5jGx234z2DIl_LIc7lMvSl6xzN-Lz4-Y9JhBHdu7B05FLbIRQinq-md4XMrtfpBfmX1X51eHzX-5jmmLrGgNxf0g9Hys--x-uyvV4_ufPln4IQajFva5eqjTASfxBwEFDFg4J9YfmMLxyRSYEm4ZZaJqiuJ4DYEvG6lzjo1MeFAaWwU0Na7xnu_2IPCxrsp36eMNwqa7szQwm7dqBOkoTQ-iSHR3RB1B5sqlRHIQA1aH0h6SBi9fg4t2Cg_J3tgtSNvA2_ScUMiChDLPFbu0fwm7mrJWmqTzXL1tKOErZraded8XvPuNx7xbVACqOO7hoDDBRdvVYxUh7aeuCMGrvruO1Kq3-SMXbNfBtA-4dbbAs60eByffdn7-xh6moycA-066Jf1jnHYoxpYJ9ooNjsZdReglznljo8PU8MbHL6-YkUjGxNKwYHH_5TRQ0-I9yr328CAP2Ik9AYmwGxAVwq5YwalwqwsuVPflHZS0Ii1ypgizmiYlzLEmrANdx5KfMuZp8TS9un2IeHyt3ujgMNnFV0QqhXCZoLoDD_C7XBfqPSQzWgbOCTeLiE9c_hLbyCZ0RsQiHtH4RaevXjJ9KiHB9Hm6oJ6x6WDkY0Q9_q9cmwy113QpX09sYljgPoBkN_TColy9E1k6pqRGE2V_rj7Zez2AEeV232ZxtH8AZYlGNGEtetLG5Z0MwWg8LDZSWgYSFJiEPD9gO7oQ7_Ug3g63lLylAa7Q7R3RBY9CTLtJMNwXAxRq8Svdd-js3JKOM1_ZvJDDxUy-0CoCZDl_ol4RQk86BrGnCuYovOhUia06-ds0eg6LapPrn5nPXEqTS2fQlKfbFTyRhbcTVKhm9YnY1MMZPJB0eI1I1aGZT8HMW7JBfgqZU-ZRiThcF0MbVV8DCW8zgljp1BnJ7m0pDfwm_pwNxzX80fM1S8ipc3CfKR4-4pIx2GwrEn9XGpDCjcVUVUrcYWrxaSmOQg-_wQ-irEwsY5INDtnF6hJ3CM3iLV7gnuh29HNXlveusyOL-BgpxM-Ca9naPB6MOKWKTKT9GHTx4qvpaa-oFSl-qpxYq4nHsN85Ekju9G2WEvYHfwQ_61Zmqp0Q2SXvN4FBzRp5TVwMX7bJLNkaz4FsP8DKfZTez_nFMNfMr-4T68YmVAvQaGvs-r9zAbLwwzR92kEZMQvzVAKbuMcpjQSN3tVzgpH9Zt5jdNgfPeLfdLrgbTbeGar5g2lBguL1tto-EBrc5VZoJuO6i_gx5R3Cj3JAh0D46_zl6S-7AZGGEJZb65jdgp7jKlZh33rW2AjNKEKwnh33hbsJ4_ywcjSyhut1Ne0ly3MHCeL0hRSA4BUjuvP61o1FR_kQyXd28fCCxOne8gWL138x9ogctVe-3QhkyFpq8ZJSPi0vDa-J51PzKhRrOxR2okf35eAg2Rlw2mPq732UXIhxfg9JXeMh5B17N93VDzXA3pIwpq6x6N_fKUw1CVyB6UmiaYvovQx5MqneOLjB512tJYY-DW4KM7qNr3ji1OuXgaoCwCb5k2RhJjL0_sGtafFXAlRO7E-8xN-g23mq0-SWvVNL2r6jRQTpbqfrSxRw6EGG3ZEMIWT1l1Ax0owsoPk_4EWAHqsser5jL1e79RVjFiHourbYQ9czusaC8fROKqOkkGXZLtTtLpscciKNBLJ_AVPRCVVCdV0lq-2W8BOJC3gWj6lQETKfk0AgLhmNohSOMGmGxnWBHGs_mzpnbt0w0AxPRCVvjwv7o_ZSB0C7X9l2JHA6vqlvqzMDUBU44DI36QQh3hHWxN6rbqHJS6RCNvZHv_Iv9fOZr5B0F8Reb-IRZShThGngpa7FB--c78YAD1QwmB47x0wujV_eTFEJU1VynKRSW64As3kMbQiN9PJkLJshN6QTEt2dqTgD51dhqK2atx45VMk4AEm7J0_xJSG3kL1-ORNrlFJ9UzbGY9MdmUKMiZ1w9IO1WhNUsMtZvoX4t3Sku9eUUVJfPILbQIQ-UTn3LQYf_SGI9_GzKKvwzTbForW1F5mKriul8Oso_LTEKqKqz5HkmX9E2du3BOIbpQhrILLhJIrZNkTuAh7VgWA-HVskSq4z-raaFPetpZAC--FUysnU4Y9B4BkG2rV7IAQF-5vwDGug2FEaRxrtEMhejhfKNAp0p-4oPvtwJajaDJqxY72mM7t_NQQU814vwWaVqeFm--8_GtnorTRjeW7wk0OZ_zqsN9OsZQYfWpnDCWDFdo2S_K7-vGUz1NbXV3Ce55RzsH2e25VXhj8du_kedBoBgY01RsIhDXRq0fPlpB_W2yKwBhcr1MLxGnc8XrUzaJaIHw60s2sAj0loTm8Dd1-a0YbJYXQY0k_gefzdeNycWzAde0lGHZuHPYtzoNIaZcomgPvxVD0HUIy4nonw0gIlwSUvotXwAFY_6lrjJ0Xbqgh8y57XP9yHg73gUSDaYeNReeeI9ZpID2DbLRPBz1UQQXFTxLYWMgCB8fL24Etnv1KWzcdvO6rOCtuHNEwkk9T6X7v0Bd8eft9VZqpInX3hvXSOiq4QY6C39Av1Zyq-H9qN4z6GnD_DtKLJexPvAZXqsTNRWd8cra80uZexLx9eLhs22d20g6Lw9PkCpSByeENcKkCChORRPfqW355LaZjcMFAD9-79je7pYKjEmvWHbFsLPEE1dRWtTaC4KDagDa160pKJHcoAM7dqjVDEJb-pkthwe9jZYVetVZclHua9Sm8MEImVEoITHEjG3CRZP9hzHjlioQ8M5Q_JSPrCDquPmLh-XECCc9dXoUeZDK-v_BOh5inIoU13z8_MkAfyZxpgOe-PlcrcjVQV2JCyfN_NePIvraQN4isGkhitc74Azb_9prHDsQLS6CkqcSzMDX0XAA58oLKT8JpKY4DkZiBC21kC6W_Wopig2OIhdVrPG912J-Xw5af8KpB9D6YHqbYE5le0bTjtIUKBBRcLIECmGTGfG53gIS4GwUJbnqJ60LvXC6NDO2vC45vw0vllLSqDKennbg2OCjyeUNySVEWsy5Xsvx1_6Oq-h7LvLJIQvFJCCNjGpwGI8lU6BPuVryPvoDGoP1w&cid=CAQSTADICaaNH-MFU4TFQU8CT7yaiNMSxDHbGI-07vdaP7mJu4GoojcI4z6jaRtMTHMUhxr0_epc6oOhcCg30scWKPpnu4KNmhajzyaxZLEYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffontesk.com%2F&ds=l&xdt=1&iif=1&cor=1471633618171313400&adk=497053795&idt=69&cac=0&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 00:05:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81164
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 00:05:06 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame 63FF 30 KB
11 KB 31ms
30ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

c75166534a7cf375f7963558a6a55858688f6c289c9d200706ce1592669ffe3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 05:55:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60154
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11596
x-xss-protection: 0
server: cafe
etag: 6499730840814102677
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 05:55:16 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 63FF 41 KB
13 KB 32ms
31ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:10:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275242
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:10:28 GMT

GET
DATA 200
OK truncated
/ Frame 63FF 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb5fdd08e21a0aeb847742475ffbad5e69857085ae6c7821e771c31baa839b59

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 21BA 38 KB
13 KB 30ms
30ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 275092
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 12 Oct 2023 18:12:58 GMT
expires: Fri, 11 Oct 2024 18:12:58 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B94C 22 KB
8 KB 31ms
30ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 274637
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 12 Oct 2023 18:20:33 GMT
expires: Fri, 11 Oct 2024 18:20:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame CD04 22 KB
8 KB 31ms
30ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 274637
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 12 Oct 2023 18:20:33 GMT
expires: Fri, 11 Oct 2024 18:20:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js Show response
pagead2.googlesyndication.com/bg/ Frame 21BA 38 KB
14 KB 34ms
34ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

sffe /

Resource Hash

6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 06:12:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 231901
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 12 Oct 2024 06:12:49 GMT

GET
H2 200 m.js Show response
ctxtfl.com/scripts/js/ Frame 63FF 19 KB
8 KB 214ms
87ms Script
text/html 34.107.189.102
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ctxtfl.com/scripts/js/m.js?id=1Aw020Tsb95W9PdgIrK1GED5D&cb=2351937016&adv=12410607&buy=30696125&cid=202318839&pid=378057975&ok=ok
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.189.102 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 102.189.107.34.bc.googleusercontent.com
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: fba3319355d570de938a0eee92bfd4c37c849e0ad53bc69df99d14334f904bfb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
via: 1.1 google
server: Apache/2.4.52 (Ubuntu)
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7534

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 12 KB
4 KB 33ms
32ms Document
text/html 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

da370f7edf80393f81e9b31645df2fffc6ed33462b3a1ff86626681ce0d2e030

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 4488
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:50 GMT
expires: Mon, 14 Oct 2024 22:37:50 GMT
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 63FF 0
0 56ms
55ms Fetch
image/gif 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssJzDkW0T2-IzS01hE8aRWhs3yeqSXraRi3s6PupPbxIaKUdK-gpo0GHWLWqC5awOzthFY1n6QAfej7zEtKxtWjCAl_i3U8s5WQlut2UVrNDoKD40nNkrbXoAsHNPLCny1pXTr8iiLmwp1AKdTcI0C4b674nc6z-5sD2DSMQQU3QW2HRPOjAvDoNI1yrYxWMFwxejYRprptLE-PsRRb3NLl5jkkk1GXcCyTMx2BYSqTiVYysKyqf024VQen0rYVxymYKf40qIvKn66vytphPM3Fn290MivcIflkMoP3lJdIF78CIpwrPthoQQp23OhdNWCfM3nJUCqzmyhKkJlGZ-fydLCHT4DhFInnP_xyf0PJYrYohvcyNzrd1UnKN9zq-mK-ImfmHAaTDLundCXXvOpYblOfxK5jNXQcouUIUQBu_lIA5SEsiM74PjQzBsXiGNXK0SjdP-NiX2yDJ6-aoTbNNmxB2b4uOL0msdy4o-invEjO2TeMrIG6FtyPqtPtz0baHUdv17fdf4NvYI351DqChiQbByQdwLCdi87tw9OaQhFUsohnNdhAtRWNH9yOO_v1HNdJWqpZm1FQ2PN4lU4kSiDov8LyTTrDwsB6t2d9agpeTRlkNg3P1bhKj9t_9wzRjZ4xU9AaztWgzOtoOTInWKZO0clijAPjsd7BhWRcSe_6q9jSz_prOurz6l9xPN1EPijXG1Dbg2v5rHQa0Nr-cu8DOebyH5BXOy_x1VAAcHql0iA6Os4FJMJKC8PNwXPyMCRhojCscedE5BBGob-hRFNQl7Ze8fpTU3bbXfgQ--c9AnI1WJTVABa-I5btS7Tr1Q4VQMwNAEPgijZJqh1JZwerSJ0QieSrIcdX22Q7wpXqMfxdIbALu_C2qxRagnMXWqfjpkN5nxYfOjJp5VynBK4vwxAh853cMmKETyFPVtgbyAaR1MA7I9dzhcoTTHhKM2G1sFMk5aY6RA3qzTciyaXPbGQWgsu2b_ksPwTLbf-QlijpjE0BnUpMh21QMO6uJy2Y26hmeYkbGnc1uSh5AWtOKRGyLYD-ViO0lISWg0n6c97ZG9xu9eKinSxFgFstjPtd0tQt40xUOYxNTHylL915Ajh0dh9dQRZWNk0JmMC6h9oesBs-oMEz445XubyJBwv-XsMMZyrRtXONWniGnZeYOpC5M-MDyvUuw0UhroIWWqA3o7FoI2UOnHu76gluuQxv5ZSVy2DLDulojNL-oyy9P-J5N8IHheFzRLiojATHdkbj3oHDb179jpu9eso1NvM9enBdjxdKEoaJ387wjeAxwin2XfNb&sai=AMfl-YRcEQpXNQt8KzJXeWkaQ7m2KEVnkKbG6iyCGyaYmDA4xqcKgpuH_jSBgcTd53oqTMytVdo7XVdlv2RTlfB9r8IDYcku3fyyCfGjsqtnmyoUsuQjgzADv-e38hwdm6X7VGyCBqnDH07G9DGS03t5FHWnn_qWWXC5KDkvngCnOWoB8EFZpUi6nLZYYQFppthE56bfFPK9xm2gxYTJM1sMcKb7QUFZwGkQRy4Sqry8U3OHl4iYRlEW7UAasPCZBJmMnGfxJRswBhRB5rS02yuLigHksa97aP5qqhmx&sig=Cg0ArKJSzJqu3whD7zogEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=140&cbvp=1&cstd=136&cisv=r20231011.00639&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js Show response
pagead2.googlesyndication.com/bg/ Frame B94C 38 KB
14 KB 30ms
30ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

sffe /

Resource Hash

6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 06:12:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 231901
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 12 Oct 2024 06:12:49 GMT

GET
H3 200 15324236509679631514
tpc.googlesyndication.com/simgad/ Frame 7990 22 KB
22 KB 33ms
33ms Image
image/png 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15324236509679631514?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlTWTO3lBWzmi-stYXaA6wIh_KUXQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=9027243322&adk=525839248&adf=309123476&pi=t.ma~as.9027243322&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468755&bpp=2&bdt=373&idt=274&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEe%7C&abl=CS&pfx=0&cms=2&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=g01fZs71po&p=https%3A//fontesk.com&dtd=281

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

be2e04cecbcfd781b640159d04691b2add96725759f769d0a253727dd74b3c2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:13:41 GMT
x-content-type-options: nosniff
age: 275049
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22095
x-xss-protection: 0
last-modified: Tue, 05 Jul 2022 09:28:35 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 11 Oct 2024 18:13:41 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame 7990 23 KB
9 KB 32ms
31ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

fc069e0e04d13807f2632483a883ed5fbd1d72c4eade64a9ac7f6aa71ac47fa4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:30:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14829
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9145
x-xss-protection: 0
server: cafe
etag: 13066256994748809036
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:30:41 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 7990 3 KB
1 KB 36ms
35ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:12:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15892
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:12:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 7990 20 KB
8 KB 31ms
31ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:30:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14824
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:30:46 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7990 187 KB
59 KB 674ms
674ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:51 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 7990 35 KB
14 KB 37ms
36ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

73e3191e8775f3d00119696caa79759b2ae87b5bf058bf6a66b626eb04580244

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:18:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15578
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14188
x-xss-protection: 0
server: cafe
etag: 9007259302920372400
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:18:12 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231011/r20110914/ Frame 3737 10 KB
4 KB 40ms
39ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231011/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 32482
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 13:36:28 GMT
etag: 2603938475786422795
expires: Sun, 29 Oct 2023 13:36:28 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxVJ1GU7j7Ge4egJl1bIbKg6oTHtLWw52ZP5vpDMa6fTILvjYrrtM1jjCSmn2Mue1N7J1ED70q51TT4z8ZD2mlJqHVgdpmqy6Bnn19e71DxLgAVpdDKBgvEfHiMkWVVu2858yWd7Qw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 59ms
58ms Script
application/javascript 172.253.115.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVJ1GU7j7Ge4egJl1bIbKg6oTHtLWw52ZP5vpDMa6fTILvjYrrtM1jjCSmn2Mue1N7J1ED70q51TT4z8ZD2mlJqHVgdpmqy6Bnn19e71DxLgAVpdDKBgvEfHiMkWVVu2858yWd7Qw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk3NDA5NDcwLDQ0ODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9mb250ZXNrLmNvbS8iLG51bGwsW1s4LCI1WVVUckVneDFHNCJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.5YUTrEgx1G4.es5.O/am=gAE/d=1/rs=AJlcJMwWr-0BoGlkDRzkqg60JHDvlnG3IA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

12dfce02502b0b0f85917255c36a8ee0bbe18f4ae21f2560c470a66332e38d5a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-xerq7lBP9FvQjw8hOheSZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-security-policy: script-src 'report-sample' 'nonce-xerq7lBP9FvQjw8hOheSZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame CC2C 143 B
166 B 33ms
31ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5952306940031097&output=html&h=90&slotname=9027243322&adk=525839248&adf=309123476&pi=t.ma~as.9027243322&w=1200&fwrn=4&fwrnh=100&lmt=1697434669&rafmt=2&format=1200x90&url=https%3A%2F%2Ffontesk.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697409468755&bpp=2&bdt=373&idt=274&shv=r20231011&mjsv=m202310100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5245609155967&frm=20&pv=1&ga_vid=2063783378.1697409469&ga_sid=1697409469&ga_hid=1885064267&ga_fc=1&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44805099%2C44805333%2C44805681%2C31078301&oid=2&pvsid=1307067186117376&tmod=880173745&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEe%7C&abl=CS&pfx=0&cms=2&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=g01fZs71po&p=https%3A//fontesk.com&dtd=281
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 1391
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:14:39 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 HYPE-754.thin.min.js Show response
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 56 KB
24 KB 52ms
52ms Script
application/x-javascript 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/HYPE-754.thin.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

684586e6772ee02828185ad005ffaf74fda242faf446b3107c68f0aff86ecef9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js Show response
pagead2.googlesyndication.com/bg/ Frame CD04 38 KB
14 KB 30ms
30ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

sffe /

Resource Hash

6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 06:12:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 231901
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 12 Oct 2024 06:12:49 GMT

GET
H2 200 redir.html Show response
p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame B69D 247 B
867 B 98ms
32ms Document
text/html 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

09bf1e08fd28c0d20259fa8dc40e44e2da04d0c6ae4e5e0bad28a08df41883fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 202
content-security-policy-report-only: script-src 'nonce-sgfpKfpxDAcVuTOGAswznw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:50 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Mon, 02 Dec 2019 20:15:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 460F 640 B
265 B 49ms
47ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPWzIBDJj_EBGN_RkuABMAE&v=APEucNW-hYGrfZfyKVSx9iUIkEa1q80xG5K79E-XDrGKx4uXUp031oJGUCQlB31QzSvvVKUr0CiOJg2erAEY7AefEaL2Smj6vA

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231011/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:50 GMT
expires: Sun, 15 Oct 2023 22:37:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame F4AE 89 KB
31 KB 64ms
64ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:50 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame F4AE 3 KB
1 KB 32ms
31ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:12:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15892
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:12:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame F4AE 20 KB
8 KB 33ms
32ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:30:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14824
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:30:46 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F4AE 187 KB
59 KB 563ms
562ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:37:51 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4AE 42 B
63 B 48ms
46ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CZ9cXrv-b5_2qXFnNu9YnEVZhu2tyByju86Cr8DCVR6THhbe1VSUez3fT3Srin8OeNi86OjB2mp4MR70Ag-kx6cSxIIb6DjZeYEtxDKRrvZ5ZIuF4

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4AE 0
20 B 48ms
47ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=11075836978485664564&x=1&ct=77

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 460F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEPsnzsYWcuIcdOq4KotJeo&google_cver=1
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEEPsnzsYWcuIcdOq4KotJeo&google_cver=1

43 B
172 B

57ms
57ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEEPsnzsYWcuIcdOq4KotJeo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPWzIBDJj_EBGN_RkuABMAE&v=APEucNW-hYGrfZfyKVSx9iUIkEa1q80xG5K79E-XDrGKx4uXUp031oJGUCQlB31QzSvvVKUr0CiOJg2erAEY7AefEaL2Smj6vA
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEEPsnzsYWcuIcdOq4KotJeo&google_cver=1
date: Sun, 15 Oct 2023 22:37:50 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 460F
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjBiYmRmYjYtYWQxZC0yYWI2LWM4OTEtMWEyMWRlNzNjMjFi

170 B
188 B

47ms
46ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjBiYmRmYjYtYWQxZC0yYWI2LWM4OTEtMWEyMWRlNzNjMjFi

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPWzIBDJj_EBGN_RkuABMAE&v=APEucNW-hYGrfZfyKVSx9iUIkEa1q80xG5K79E-XDrGKx4uXUp031oJGUCQlB31QzSvvVKUr0CiOJg2erAEY7AefEaL2Smj6vA

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjBiYmRmYjYtYWQxZC0yYWI2LWM4OTEtMWEyMWRlNzNjMjFi
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame 460F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEDNrMgzHgJUxLuenWtdo9DM&google_cver=1

23 B
278 B

73ms
39ms

Image
image/gif

104.112.20.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEDNrMgzHgJUxLuenWtdo9DM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPWzIBDJj_EBGN_RkuABMAE&v=APEucNW-hYGrfZfyKVSx9iUIkEa1q80xG5K79E-XDrGKx4uXUp031oJGUCQlB31QzSvvVKUr0CiOJg2erAEY7AefEaL2Smj6vA
Protocol: H2
Server: 104.112.20.199 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-112-20-199.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

expires: Sun, 15 Oct 2023 22:37:50 GMT
pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEDNrMgzHgJUxLuenWtdo9DM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 460F
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ODYzODNhMmYtMmFjMi00NmYxLWI4ZmItMzhhODE2YjVkODc4

170 B
188 B

46ms
46ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ODYzODNhMmYtMmFjMi00NmYxLWI4ZmItMzhhODE2YjVkODc4

Requested by

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
server: pekko-http/1.0.0
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ODYzODNhMmYtMmFjMi00NmYxLWI4ZmItMzhhODE2YjVkODc4
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Sun, 15 Oct 2023 22:37:50 GMT

GET
H2 200 iframe.html Show response
p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame B69D 5 KB
2 KB 32ms
31ms Document
text/html 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

08f3747a1e5f2ab412c6448b80e5dc23ed566a05d0d16be95fd553d171418f9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 1986
content-security-policy-report-only: script-src 'nonce-10fx3QkDfnZlYGt9vJnY1A' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:50 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Fri, 03 Feb 2023 22:38:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7990 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 91701c746053a0c71e304f67aea5037abe2d2dc6ef18b54d0ab962b4dcd8a56d

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 AGSKWxX7HcEjQ2DdUCNE7Eco36v6vBPhB0lPTyFu5R8h-V7OjZEVe--j6b2QJTzuxIddLPlT-jQGzsH28AUz_mkvqHj-UBUCuHcHV-a-bWPuT390Q_IeaAA8ckTCuM-ddIyVX31Q0rF8_w== Show response
fundingchoicesmessages.google.com/f/ 13 KB
6 KB 81ms
80ms Script
application/javascript 172.253.115.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX7HcEjQ2DdUCNE7Eco36v6vBPhB0lPTyFu5R8h-V7OjZEVe--j6b2QJTzuxIddLPlT-jQGzsH28AUz_mkvqHj-UBUCuHcHV-a-bWPuT390Q_IeaAA8ckTCuM-ddIyVX31Q0rF8_w==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk3NDA5NDcwLDY1ODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vZm9udGVzay5jb20vIixudWxsLFtbOCwiNVlVVHJFZ3gxRzQiXSxbOSwiZW4tVVMiXSxbMTgsIltbWzBdXV0iXSxbMTksIjIiXSxbMTcsIlswXSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

2ca79572ed475ed817422bc6d7fb46d6c761ca8089a91c560104d03fdff438fd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-jBINt5M0KNv_bl5sD8K9uQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-security-policy: script-src 'report-sample' 'nonce-jBINt5M0KNv_bl5sD8K9uQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 4 KB
2 KB 33ms
32ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

d22a5815111d8a60a1bfa58b46b1447dd0ea420e12fbb0e0d362d76cbbb2b02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1734
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 tarte.png
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 38 KB
38 KB 62ms
58ms Image
image/png 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/tarte.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

6b205579c96d4af81de9760c8d15e8650ae5cf631d9d33f9b4ebe043bca11e8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39046
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 tarte-1.png
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 15 KB
15 KB 49ms
45ms Image
image/png 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/tarte-1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

cf88d530c655fa92a90277d42f7c7cbb19fe276a0de7f126a26d26dfc865d7f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15314
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 pomme1.png
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 5 KB
5 KB 73ms
70ms Image
image/png 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/pomme1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

71ac3ef341fa8de6312d99bbb8f4f634f945c42f7c79b8a41efaec04755594bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4950
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 pomme2.png
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 5 KB
5 KB 89ms
86ms Image
image/png 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/pomme2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

3f54399e354e9d8a91bb2bf19e612d8441b697ea2d1612a9e107c2923464a23b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5480
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 truck_EN.png
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 7 KB
7 KB 58ms
56ms Image
image/png 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/truck_EN.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

63f3df4bf2104aa23a3739385a9cbd0b84a434cdbbd838d2a2ceecff1cd5a172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7155
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 promo_EN_2.svg
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 13 KB
4 KB 41ms
39ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/promo_EN_2.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

1dbc05b4740d823839cc8fe7c0eaba8566e1318c5a068c96b9dc64ea19b8bfb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3720
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 CTA_EN.svg
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 5 KB
2 KB 40ms
37ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/CTA_EN.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

96477eb47aaf4572b26b38a8f10631b5ce4d0bc3bcda800d747aa3c11acdcbdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1688
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 legal_EN.svg
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 11 KB
3 KB 44ms
41ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/legal_EN.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

0ac9a63e8e0753eddca5bb35b1a5bf103d220313411958d50083c8a33938b779

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2839
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 free_pickup.svg
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 3 KB
1 KB 38ms
36ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/free_pickup.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

91b2efa7f6f27aeb2bd108a6f93cb87b68c56acebcb037372084a46471280d75

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1052
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 tag_EN.svg
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 3 KB
1 KB 44ms
42ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/tag_EN.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

883340c9cd61a0bcbc7710b16ae16b1f89441492fbff4fba713818998a491dc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1470
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H3 200 titre_EN_B.svg
s0.2mdn.net/sadbundle/13574684379673229437/ Frame CA71 3 KB
1 KB 46ms
43ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13574684379673229437/titre_EN_B.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

6009c9ac26db5e2346105cea724729d420a4ca5eb89208e2565faa9013f1b976

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13574684379673229437/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1109
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 15:14:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Oct 2024 22:37:50 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4AE 0
20 B 45ms
45ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=840869453832&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4AE 0
20 B 45ms
44ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=840869453832&version=m202309260101&ct=77&x=1&cor=11075836978485664000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F4AE 30 KB
18 KB 79ms
79ms Script
text/javascript 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Af3Z3vD6u7LdDz6jVvBqvAAnOthi0rRIH-3Fbq1gHgpksLenDCMxeefGvck5IuaKS8inuEr6nhr8J6xu2Avp2EYSJoJ3q0prkviIo7lkN7N5fpGIzpmXZZ01Poa6AgqfaqUj3gS95NqIq7n2rGARukFMFqAEYqox-bvWSIYz6OzPnGsV4&cry=1&dbm_d=AKAmf-AxQu9gefs4HCiFZcss6jdPt-2LaxPPsLQNmwPnd2KTGyidfL5Y4vLwBHtgZpiCSBO-E9NN-qmrYHBoMNFBueYy9lnT0Pkn9uHn_j90eIKUPFp_jPdSnRJYXVJDr19rLzHOfn7rVCJKc7BIP721Dpn87UiK1IQV7SqkX3SaxzxGyKjHehl2bR-R64pqCY0_GfuRI7xURFrT_1Ks2aK-00ybKE5NMuVXG7uLT8z9TfWRTZ1qi-iJPg_AePkl_nu-QSjGUF-8Rp7qlqG77vt58kn4zHr4e30H31APSK5Lpyzco2bx5uG1_f-EeZnSFBHvn7eYmQSkwXHZ20YMxgS9YMptDRNGTgU6JnMZZtcecoDFOWDl8gZ0tLMDark2Gkl4t7UEpjP44CNDWUiAzD1nruP9iTZPuLIftx3u74_lus1cDMxgmWo1nxXPWc-E65ldE4d_K9MAYy7ije_0u4FIqivPcEGHpuWn8X0VPOPv-XwLVM4BK5NSGbwVF7SuTbaM2_VDP-5QvEWsnaosPh2DcardsgE1VdMApCdYhtK425fJNzjFZC6iCmx_E-cQjQQkNLzliCfB6nqbxVGXMq6YyQRxi4C0b8Zwed-9hKTuMdP6yLMjkDKvCrApP8WMU-f3iRclDx-s3_emf7fQJeoCNFn7Zm3VaKujZDlHfz5zdOeCYbO2WwaFVuElq9BQIJqPXobJAYpKqAGi1EwpoirgtrFsf-O8Ypdnaygxg1O3kyJsqxGOF3EkCDwZ-v7Hw1lRGDHbhhGY4-2B4E7kU0RoK51lX92c4ICgkZp1SyDihp8rft4a4FsXCTRa1ZC33DX7j-ZA4iVLH2JiAoyWhJs2Nlrrh_g32ZGJk73dSzuPiLiacopZpheQ7c058Y2qQ0Qd7ySSKTkBrPVtZVnNqieziEh6_o8qqMxyoBqv2097C3re3HVaYKJCshFL8dD2cRolVqbXYDdjdyWp5tfoqsoLuxpA9s2ICUqQYhVfcamptnkPhPbvwR1dMiYJaZXTv-VCG4wUtFb12KvhxLz5SZB9d1yI5feCxc93HyaYdjuA6xAVt-MlzMgiv6QIvT0S-mtQTVvZ0vem6lra9GdkSkZe5d6p_WZY1GMJBnriOnlVmQ45au9LVlDiiqeOtAjsaqHi1ylxpUO9oPeo4Vuq1vIJ1xMtyA5wzHmUsIiHyZw2aK_SzOD8jeVUxrPLIWv5vtmQGfNmvw9IrKnQ_4EeV7-YAejva1qfWZjSSzb2uLStdtK_mbDfYTL8rykjrnpMgDJDidnFKvi-gml_Vf6K8BfoEezGYDq-wp2ulSvzEzDb-zruxtmYo5b064_Z02nnTdQ65rTMH86vX6VUO3ifhZor0yQnrJR0l70EN2wJqIMI9XCpZ2jjYkVhD3cOnj_dx6xO4vhnlQGREoQ72rLPem36_Tpj30_lWALCJBk07hC2f_KIEL5Rq0ok2uCqltbtg8NAx2c4kUkaLUcfIiw853vEUL4wuhVWYEzbiSWyu2RpK1flV9jweIyDN6yGRrfPjdtcV9LZvOLIP_Y5CeTn8rYWMk7K2luOXKfvGBDaPOrNmjUf0iWVuPtjmRnvp4nNyhI9hJ4C8gAD2CkNpPgA2h7jgB-7jr1mtDbwAIMSfs91ioL2OQ3MP9cZ6mGnBQPESMLjB0g3xcfHWVcMDdjcTtqJ4yBN2YhFmC_V24g5GpPSlMsS6MWMIn45a3OkKoN8qIMDVTadcUOPnXr3DY9S2oFKU1n1RdjZ_RqqKaHPCNBAFTk-BQg-5cuRU_vZM-HNeOQGONqxO3CqRMhsLnUwYZ7bkTCvRf8iHf8GNbOeEPPc2naahv6MbJa0vGIS24b-7OcqtycYqhqO3zzKYO4CevShcPU-LPD49NSHApVF76REZIZsRMlglelvEHr8mL5VGoEYgv6Bvkt6GUMMiANTwz_Ap2zw4xZ7OBg8LjWJm4EeQHfwpTjU0f4N3LoJANXU5PQx9vnPoRW0hOaOzi-usgYDsvIAbAJ6dF5-DlbmPfD-IJUlpqb5n1MJO9fxBTuJrvcSCNvipdm6OYHfpWitVyIS_ph35RgK_DZxe1L08MrA0PWZUrDnG-5GiW11c2HfX4HpbI6FTFoHi9nl6riC2RzOckxbYYB_G6-qMAGR2SySI_IVkRZMvL_wgJvPCWXBEPWE_7IAT9jsj2c-QoKaVQqXbOlXEQ-VHGIoULMx1rZtc-mzYA91cz0mijnU0M-0E57NONj9KxwFcE_rSdX34Lm-Hh50KUlg3DZofGv53t6J3UJ37LZSgRxBzchk42cqIik6UMDdbt0zxHLCPm1tIV5F6z6Q74NXBuH2Bg26HCjhjMV1mdwvcrmjVZ0ZwEZIOb5TOTuyRtutxHBO0KVzQxFHlZCemHkXI4MwZZn5j3ragD9mcbQfgj9jbobauJmdrqU390JpvZYO9anVZlcGQQopfNxk4dyQE-2QUwG6nljgIeR6m3PRYPp6MMWGl1SzRJUCB7PIpCY4-bqC-9APWXyjWx1KCN7ZVWYeDcsWNB-pZVHGg30lUOYOcDx1EUuJQE3TR9HwRLTk_9fHq8-jVvDkTGI5vkn2Dl9xDEKIxtfZ5fLKUKO-yDH1IapBQxthGrldRx8TATl96U2GcwWkz_lZ5wv8qi6DQlVbxop_e4XOtfVGZP_a6jPq9cB7WXRBDiS0m92wgVXzHrkAodM2NZp9BPvUQPi_S5ZTnfNISkZWwS6eGLO8RhqdQqPwypjtL-_q8310bYrvNpud9xQ62OcV4ilFKoxH9VBq0p8BTimSBaIVTwNadU9AYf4_NTUY5s5xP03vQCMRMPRst5cHMjSJhd22iukJbVNTUCMCd3JI79y_ndVomfzRIZZinb9P4nn-G9b2dw8k7IrOU472A1QkhKXsGIIh02GcuhbIvgz-gdts-aUYuRQtPpLvvJZPw4v_FneKxCd8wNKQpeYql_spKTZZU5zu6maNqNfbX2fqUvQBhDqlo-NJeYoYYv5XLTZaz8QNSNkm4HfURuQup1L07a5ve1jaUsJEa-AlBgmabmUELNNSL7eZ5znB9vOqtLh3yAerG4VyHjEvOTiGHDr0Ki6XmlDSyVSUgOa0RnJBDyd5L-MDWwhrZtYqPYQG-MZH6bn2tqq98HW9HrP2AGk383w9jXvNEksBa8QemXncbpDu6ccZQgkZ63B0QVYcep19emQbjIAeitUJtKbgXiX0k5MjVMTxlhVvvtUYj1noFX6KvKjBpLmGIwcbEwaVYSeBalNOdXHr3jvFK3z6DvZ2XR9hl4VwVI9lDFSYJ9EB14pTG5DskzZQqzsjyAb9p09R45wy4dfopRZSN65uxVxyi8lycfd0wpHK1c5p_Zl8V2_iqvKv1rig2qNWMUIfIfPLpad8nQi-iJKRpWbvxEfcipkDgS7m54Cc8_dxebft-APQWAYZR2trPqN2OGnPl2ac6DyJ5U60dbg7X5XVKhUo52iv-Xiw8VZQdQhk8v07ziFXgODN6DaSSEYWCgITt9GAUelTuXiOlqrWADqCmBacDMb3Zj_x0PGsvKoAfNLHZPDT3oiuDkIXrDckGQACTF3iZy6E4q7rEiLhloe7I6DOrxxajhJNrpIda8rlPtVx4ws7jQReIz_29FARYM-Eg-zH5pm-fKXMgSkxVvI4of-QwQckhf5lQCbmdeIhKXUQbzpV9xidcC-14PwukZYkH7AP0CfK_FL6lo0CDQjcnCnvbkYhX69_yD2s0VW8_Y2Z5nbk39jcbXw&cid=CAQSTADICaaNBGHf346gWOuOb9Pa2aKku1MIALuaQ0k-SZqCWC1jbI1FQh1sB4jQrvTBcXMV2Dl-PG5ltZIg6CrD-gWP-6EModdDrxxcqA0YAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffontesk.com%2F&ds=l&xdt=1&iif=1&cor=11075836978485664000&adk=2935317967&idt=68&cac=0&dtd=13

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

90bb128a583d62944d449e07f21b9a1da1fd7b3f7a5e2a2725fa028de809d108

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231011/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18191
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame CC2C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

49ms
48ms

Document
text/html

142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:50 GMT
expires: Sun, 15 Oct 2023 22:37:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:50 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H3 200 cracq
ctxtfl.com// Frame 0
0 104ms
52ms Preflight
text/html 34.107.189.102
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ctxtfl.com//cracq
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.189.102 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 102.189.107.34.bc.googleusercontent.com
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Sun, 15 Oct 2023 22:37:50 GMT
server: Apache/2.4.52 (Ubuntu)
via: 1.1 google

POST
H3 200 cracq Show response
ctxtfl.com// Frame 63FF 18 B
32 B 63ms
62ms XHR
text/html 34.107.189.102
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ctxtfl.com//cracq
Requested by: Host: ctxtfl.com
URL: https://ctxtfl.com/scripts/js/m.js?id=1Aw020Tsb95W9PdgIrK1GED5D&cb=2351937016&adv=12410607&buy=30696125&cid=202318839&pid=378057975&ok=ok
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.189.102 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 102.189.107.34.bc.googleusercontent.com
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: 24331bbdf40c95e911c59ea6beb4dea06c862b129605ad6f06f845fc1f0f059e

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-type: application/octet-stream

Response headers

access-control-allow-origin: *
date: Sun, 15 Oct 2023 22:37:50 GMT
via: 1.1 google
server: Apache/2.4.52 (Ubuntu)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18
content-type: text/html

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 63FF 0
0 49ms
49ms Fetch
image/gif 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssJzDkW0T2-IzS01hE8aRWhs3yeqSXraRi3s6PupPbxIaKUdK-gpo0GHWLWqC5awOzthFY1n6QAfej7zEtKxtWjCAl_i3U8s5WQlut2UVrNDoKD40nNkrbXoAsHNPLCny1pXTr8iiLmwp1AKdTcI0C4b674nc6z-5sD2DSMQQU3QW2HRPOjAvDoNI1yrYxWMFwxejYRprptLE-PsRRb3NLl5jkkk1GXcCyTMx2BYSqTiVYysKyqf024VQen0rYVxymYKf40qIvKn66vytphPM3Fn290MivcIflkMoP3lJdIF78CIpwrPthoQQp23OhdNWCfM3nJUCqzmyhKkJlGZ-fydLCHT4DhFInnP_xyf0PJYrYohvcyNzrd1UnKN9zq-mK-ImfmHAaTDLundCXXvOpYblOfxK5jNXQcouUIUQBu_lIA5SEsiM74PjQzBsXiGNXK0SjdP-NiX2yDJ6-aoTbNNmxB2b4uOL0msdy4o-invEjO2TeMrIG6FtyPqtPtz0baHUdv17fdf4NvYI351DqChiQbByQdwLCdi87tw9OaQhFUsohnNdhAtRWNH9yOO_v1HNdJWqpZm1FQ2PN4lU4kSiDov8LyTTrDwsB6t2d9agpeTRlkNg3P1bhKj9t_9wzRjZ4xU9AaztWgzOtoOTInWKZO0clijAPjsd7BhWRcSe_6q9jSz_prOurz6l9xPN1EPijXG1Dbg2v5rHQa0Nr-cu8DOebyH5BXOy_x1VAAcHql0iA6Os4FJMJKC8PNwXPyMCRhojCscedE5BBGob-hRFNQl7Ze8fpTU3bbXfgQ--c9AnI1WJTVABa-I5btS7Tr1Q4VQMwNAEPgijZJqh1JZwerSJ0QieSrIcdX22Q7wpXqMfxdIbALu_C2qxRagnMXWqfjpkN5nxYfOjJp5VynBK4vwxAh853cMmKETyFPVtgbyAaR1MA7I9dzhcoTTHhKM2G1sFMk5aY6RA3qzTciyaXPbGQWgsu2b_ksPwTLbf-QlijpjE0BnUpMh21QMO6uJy2Y26hmeYkbGnc1uSh5AWtOKRGyLYD-ViO0lISWg0n6c97ZG9xu9eKinSxFgFstjPtd0tQt40xUOYxNTHylL915Ajh0dh9dQRZWNk0JmMC6h9oesBs-oMEz445XubyJBwv-XsMMZyrRtXONWniGnZeYOpC5M-MDyvUuw0UhroIWWqA3o7FoI2UOnHu76gluuQxv5ZSVy2DLDulojNL-oyy9P-J5N8IHheFzRLiojATHdkbj3oHDb179jpu9eso1NvM9enBdjxdKEoaJ387wjeAxwin2XfNb&sai=AMfl-YRcEQpXNQt8KzJXeWkaQ7m2KEVnkKbG6iyCGyaYmDA4xqcKgpuH_jSBgcTd53oqTMytVdo7XVdlv2RTlfB9r8IDYcku3fyyCfGjsqtnmyoUsuQjgzADv-e38hwdm6X7VGyCBqnDH07G9DGS03t5FHWnn_qWWXC5KDkvngCnOWoB8EFZpUi6nLZYYQFppthE56bfFPK9xm2gxYTJM1sMcKb7QUFZwGkQRy4Sqry8U3OHl4iYRlEW7UAasPCZBJmMnGfxJRswBhRB5rS02yuLigHksa97aP5qqhmx&sig=Cg0ArKJSzJqu3whD7zogEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=571&vt=11&dtpt=431&dett=3&cstd=136&cisv=r20231011.00639&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame F4AE 30 KB
11 KB 33ms
33ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Af3Z3vD6u7LdDz6jVvBqvAAnOthi0rRIH-3Fbq1gHgpksLenDCMxeefGvck5IuaKS8inuEr6nhr8J6xu2Avp2EYSJoJ3q0prkviIo7lkN7N5fpGIzpmXZZ01Poa6AgqfaqUj3gS95NqIq7n2rGARukFMFqAEYqox-bvWSIYz6OzPnGsV4&cry=1&dbm_d=AKAmf-AxQu9gefs4HCiFZcss6jdPt-2LaxPPsLQNmwPnd2KTGyidfL5Y4vLwBHtgZpiCSBO-E9NN-qmrYHBoMNFBueYy9lnT0Pkn9uHn_j90eIKUPFp_jPdSnRJYXVJDr19rLzHOfn7rVCJKc7BIP721Dpn87UiK1IQV7SqkX3SaxzxGyKjHehl2bR-R64pqCY0_GfuRI7xURFrT_1Ks2aK-00ybKE5NMuVXG7uLT8z9TfWRTZ1qi-iJPg_AePkl_nu-QSjGUF-8Rp7qlqG77vt58kn4zHr4e30H31APSK5Lpyzco2bx5uG1_f-EeZnSFBHvn7eYmQSkwXHZ20YMxgS9YMptDRNGTgU6JnMZZtcecoDFOWDl8gZ0tLMDark2Gkl4t7UEpjP44CNDWUiAzD1nruP9iTZPuLIftx3u74_lus1cDMxgmWo1nxXPWc-E65ldE4d_K9MAYy7ije_0u4FIqivPcEGHpuWn8X0VPOPv-XwLVM4BK5NSGbwVF7SuTbaM2_VDP-5QvEWsnaosPh2DcardsgE1VdMApCdYhtK425fJNzjFZC6iCmx_E-cQjQQkNLzliCfB6nqbxVGXMq6YyQRxi4C0b8Zwed-9hKTuMdP6yLMjkDKvCrApP8WMU-f3iRclDx-s3_emf7fQJeoCNFn7Zm3VaKujZDlHfz5zdOeCYbO2WwaFVuElq9BQIJqPXobJAYpKqAGi1EwpoirgtrFsf-O8Ypdnaygxg1O3kyJsqxGOF3EkCDwZ-v7Hw1lRGDHbhhGY4-2B4E7kU0RoK51lX92c4ICgkZp1SyDihp8rft4a4FsXCTRa1ZC33DX7j-ZA4iVLH2JiAoyWhJs2Nlrrh_g32ZGJk73dSzuPiLiacopZpheQ7c058Y2qQ0Qd7ySSKTkBrPVtZVnNqieziEh6_o8qqMxyoBqv2097C3re3HVaYKJCshFL8dD2cRolVqbXYDdjdyWp5tfoqsoLuxpA9s2ICUqQYhVfcamptnkPhPbvwR1dMiYJaZXTv-VCG4wUtFb12KvhxLz5SZB9d1yI5feCxc93HyaYdjuA6xAVt-MlzMgiv6QIvT0S-mtQTVvZ0vem6lra9GdkSkZe5d6p_WZY1GMJBnriOnlVmQ45au9LVlDiiqeOtAjsaqHi1ylxpUO9oPeo4Vuq1vIJ1xMtyA5wzHmUsIiHyZw2aK_SzOD8jeVUxrPLIWv5vtmQGfNmvw9IrKnQ_4EeV7-YAejva1qfWZjSSzb2uLStdtK_mbDfYTL8rykjrnpMgDJDidnFKvi-gml_Vf6K8BfoEezGYDq-wp2ulSvzEzDb-zruxtmYo5b064_Z02nnTdQ65rTMH86vX6VUO3ifhZor0yQnrJR0l70EN2wJqIMI9XCpZ2jjYkVhD3cOnj_dx6xO4vhnlQGREoQ72rLPem36_Tpj30_lWALCJBk07hC2f_KIEL5Rq0ok2uCqltbtg8NAx2c4kUkaLUcfIiw853vEUL4wuhVWYEzbiSWyu2RpK1flV9jweIyDN6yGRrfPjdtcV9LZvOLIP_Y5CeTn8rYWMk7K2luOXKfvGBDaPOrNmjUf0iWVuPtjmRnvp4nNyhI9hJ4C8gAD2CkNpPgA2h7jgB-7jr1mtDbwAIMSfs91ioL2OQ3MP9cZ6mGnBQPESMLjB0g3xcfHWVcMDdjcTtqJ4yBN2YhFmC_V24g5GpPSlMsS6MWMIn45a3OkKoN8qIMDVTadcUOPnXr3DY9S2oFKU1n1RdjZ_RqqKaHPCNBAFTk-BQg-5cuRU_vZM-HNeOQGONqxO3CqRMhsLnUwYZ7bkTCvRf8iHf8GNbOeEPPc2naahv6MbJa0vGIS24b-7OcqtycYqhqO3zzKYO4CevShcPU-LPD49NSHApVF76REZIZsRMlglelvEHr8mL5VGoEYgv6Bvkt6GUMMiANTwz_Ap2zw4xZ7OBg8LjWJm4EeQHfwpTjU0f4N3LoJANXU5PQx9vnPoRW0hOaOzi-usgYDsvIAbAJ6dF5-DlbmPfD-IJUlpqb5n1MJO9fxBTuJrvcSCNvipdm6OYHfpWitVyIS_ph35RgK_DZxe1L08MrA0PWZUrDnG-5GiW11c2HfX4HpbI6FTFoHi9nl6riC2RzOckxbYYB_G6-qMAGR2SySI_IVkRZMvL_wgJvPCWXBEPWE_7IAT9jsj2c-QoKaVQqXbOlXEQ-VHGIoULMx1rZtc-mzYA91cz0mijnU0M-0E57NONj9KxwFcE_rSdX34Lm-Hh50KUlg3DZofGv53t6J3UJ37LZSgRxBzchk42cqIik6UMDdbt0zxHLCPm1tIV5F6z6Q74NXBuH2Bg26HCjhjMV1mdwvcrmjVZ0ZwEZIOb5TOTuyRtutxHBO0KVzQxFHlZCemHkXI4MwZZn5j3ragD9mcbQfgj9jbobauJmdrqU390JpvZYO9anVZlcGQQopfNxk4dyQE-2QUwG6nljgIeR6m3PRYPp6MMWGl1SzRJUCB7PIpCY4-bqC-9APWXyjWx1KCN7ZVWYeDcsWNB-pZVHGg30lUOYOcDx1EUuJQE3TR9HwRLTk_9fHq8-jVvDkTGI5vkn2Dl9xDEKIxtfZ5fLKUKO-yDH1IapBQxthGrldRx8TATl96U2GcwWkz_lZ5wv8qi6DQlVbxop_e4XOtfVGZP_a6jPq9cB7WXRBDiS0m92wgVXzHrkAodM2NZp9BPvUQPi_S5ZTnfNISkZWwS6eGLO8RhqdQqPwypjtL-_q8310bYrvNpud9xQ62OcV4ilFKoxH9VBq0p8BTimSBaIVTwNadU9AYf4_NTUY5s5xP03vQCMRMPRst5cHMjSJhd22iukJbVNTUCMCd3JI79y_ndVomfzRIZZinb9P4nn-G9b2dw8k7IrOU472A1QkhKXsGIIh02GcuhbIvgz-gdts-aUYuRQtPpLvvJZPw4v_FneKxCd8wNKQpeYql_spKTZZU5zu6maNqNfbX2fqUvQBhDqlo-NJeYoYYv5XLTZaz8QNSNkm4HfURuQup1L07a5ve1jaUsJEa-AlBgmabmUELNNSL7eZ5znB9vOqtLh3yAerG4VyHjEvOTiGHDr0Ki6XmlDSyVSUgOa0RnJBDyd5L-MDWwhrZtYqPYQG-MZH6bn2tqq98HW9HrP2AGk383w9jXvNEksBa8QemXncbpDu6ccZQgkZ63B0QVYcep19emQbjIAeitUJtKbgXiX0k5MjVMTxlhVvvtUYj1noFX6KvKjBpLmGIwcbEwaVYSeBalNOdXHr3jvFK3z6DvZ2XR9hl4VwVI9lDFSYJ9EB14pTG5DskzZQqzsjyAb9p09R45wy4dfopRZSN65uxVxyi8lycfd0wpHK1c5p_Zl8V2_iqvKv1rig2qNWMUIfIfPLpad8nQi-iJKRpWbvxEfcipkDgS7m54Cc8_dxebft-APQWAYZR2trPqN2OGnPl2ac6DyJ5U60dbg7X5XVKhUo52iv-Xiw8VZQdQhk8v07ziFXgODN6DaSSEYWCgITt9GAUelTuXiOlqrWADqCmBacDMb3Zj_x0PGsvKoAfNLHZPDT3oiuDkIXrDckGQACTF3iZy6E4q7rEiLhloe7I6DOrxxajhJNrpIda8rlPtVx4ws7jQReIz_29FARYM-Eg-zH5pm-fKXMgSkxVvI4of-QwQckhf5lQCbmdeIhKXUQbzpV9xidcC-14PwukZYkH7AP0CfK_FL6lo0CDQjcnCnvbkYhX69_yD2s0VW8_Y2Z5nbk39jcbXw&cid=CAQSTADICaaNBGHf346gWOuOb9Pa2aKku1MIALuaQ0k-SZqCWC1jbI1FQh1sB4jQrvTBcXMV2Dl-PG5ltZIg6CrD-gWP-6EModdDrxxcqA0YAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffontesk.com%2F&ds=l&xdt=1&iif=1&cor=11075836978485664000&adk=2935317967&idt=68&cac=0&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

c75166534a7cf375f7963558a6a55858688f6c289c9d200706ce1592669ffe3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 05:55:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60154
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11596
x-xss-protection: 0
server: cafe
etag: 6499730840814102677
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 05:55:16 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame F4AE 41 KB
14 KB 32ms
32ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:15:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 274942
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:15:28 GMT

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/imp/1/202177;7164313;201;js;DV360;RotmanJan2023ExecutiveLeadershipProgram728x90/ Frame F4AE 2 KB
1 KB 109ms
37ms Script
text/javascript 23.44.208.234
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://servedby.flashtalking.com/imp/1/202177;7164313;201;js;DV360;RotmanJan2023ExecutiveLeadershipProgram728x90/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231011%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-1-%26adk%3D1812271801%26client%3Dca-pub-5952306940031097%26fa%3D1%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26xpc%3DgZt65dIvsr%26p%3Dhttps%253A%2F%2Ffontesk.com&gdpr=&gdpr_consent=&us_privacy=${US_PRIVACY}&cachebuster=102148.46193013227

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231011/r20110914/zrt_lookup.html?fsb=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.44.208.234 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-44-208-234.deploy.static.akamaitechnologies.com

Software

prod-xre-app38.ash11 /

Resource Hash

c908c62fead4036b06f6d10213cfad3bbbc3ca3aa4f8a6eb81dd9ad598f73fa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 15 Oct 2023 22:37:50 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=86400
Server: prod-xre-app38.ash11
Vary: Accept-Encoding
Content-Type: text/javascript;charset=ISO-8859-1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 835
Expires: Sun, 15 Oct 2023 22:37:50 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 8331 38 KB
13 KB 31ms
30ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 275092
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 12 Oct 2023 18:12:58 GMT
expires: Fri, 11 Oct 2024 18:12:58 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 21BA 0
20 B 48ms
48ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BQvXzvWksZairNOXKoPwP4MqOsAgAAAAAOAHgBAI&bg=!tbaltvnNAAYMG8UMLBs7ADQBe5WfOEyHkY7s3Kv0jZeqfsz9cr0hIZM-l6FkbJ-umkPqeK5pq4FmjL-O2-sTddUweiT8AgAAAYpSAAAACWgBB5kC72lSxOGRDxXX75DJ1Wcf_1_XRZFNe9IZkLbV5Jgt6jqZHun3s6aKkRRq1I8UhH1BF76vBgcsJ_3DJRmFiIjkcd2J8UcxVzUuys1jnUtXRrY7BY-S_gQ41FifYhvBSUmAgCSF1EaPRowWsYdu1W2IHX5zv0MHMhvdEJ1SN5pw-ZkU121NJ_d4jTZ9kwChXPo4EuXD6V32NnmXJkos4e0-k3ff0_FTKBmLR4--8aDB2ccYNNNG74xGEtxTL1nHG9xYnNwtsS5tRDmnYy0Z2b3Z_Q11U8TNGVXqurxae196dljQCN3IafPo3LBWYh6Y1sGY1fVqnsiiZXTRKXJgl4g5zouZIAubydGULRJAn6bovLfPPbL9_DUBysB6CXcNf5d2Gcrq7KjNw9wXw-nubJ4kbAHDXKRdX8UZxMYLaa6bjIt_oLbSOksUbHzC0nSW-jh1f8SbpC1Wvvbl96d3pJDWLkDAxxVMoTUTYzUgA23f0jGIznlpfWJEUa6FqepDcDmr0O7sJSMQw_OimxIrxI9AgqbAybyJFhAIt5o2ySPMyqwrOqI8B4Kr4agRP_gRpxkVu_67dv_LEDrKU7OBxyle7goP9wiwVs9cktuNK5f9VMjCLrpERyJtWZpo03RmYZRUuuaohYjVCfjZLoNDAxxBiNHffiS95OAXvcek4zE_MztdM-UKcQHkc9dRG6s09QDm864PQ8IH-RatOohHpG_aT6C6ZJqCCHo3fiPPqObn1VZWuPosls-Vm4AEZybvcR3DzNAUw1RNDO6VEjTeWIiB5ok8ihVD0c-eArP4LDLyOw75tLZiuFO0xtpF-FwUQWaafxUirPoSbOismPMDuVz_MImJH2loJnTEhaN6YRhHckweAPyoCIAbEVey-gBJXTY5fOLo7SwDx6duOynADPBcdiEWRrafiUXN-SjT2OT8xpkg9AexUdHgjfsoCJAC9Y6RfFUHvCO953N26P9SbYowXEeuqO0FX4OdvQMXkOf1fzY

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B94C 0
20 B 47ms
46ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BVnJsvWksZafGNY7b_gTy-oKgCgAAAAA4AeAEAg&bg=!cHOlczzNAAYMG8UMLBs7ADQBe5WfODiUFWp4SX0c6XjGPzifsdrij_xLwWT8ZE8MZLXE5d61ko6XWu-R_PeNuCOF3sh4AgAAAVRSAAAAB2gBBwoAJjIbNxAD08pACp6h8lh9jYVN-GV66tZNcfWBjj5CekzwTgu8ipNvmQMCqi7E1MfYo5oAhttnn-zVYj5wDzSgGBWKGPkFgS0Vl56XWMj96DxPM_iobmAbzITZw024j79QqPzg8Uh97EYfkUzfeSagxRws0_yDlVQtCQm8iRzJGvZa4KTGhI3MU9lSCkhD1H6ksVrOWBhp3II7e3z6_qkmJArz7ZqvoJT2SYsHXq_4I6AREqGCvXzpBOQlr5abgA25RjI6GBs1T4Oo1LMAwe7WV6vj8M0xTmty6rXfiNWtuzY4jN1JfOvLBwuZDtJDsoEMZIDj_zBMdfWzB98uo26USwsHbsK6fMUYvj766uVGM5wKzMmDHdb4EBLrupiKpkxxCm3RBh6eVD1RAumnhI6VgccGiER1SKyqBlYm_iqeuEpItSOM6banQmNtJ_SC8fX7crmSCGK1urac0mGHyXd_JMVXyr-_1fvJOHYf8uUx84f2YGrhgxG47qBdu_WrfDA3T0FLiWW0wN_2EwVADYNeniQtx1tunLXE4MT_Dyv9aca1pz3r4MezTBvuw_psCabkXOGDAUwBc8Ou9iwjRZY1uLeuj1qhZA-rU99rZLLkBk-XNUZGmJrERv8vU24QF4Vwo2CKV1dV-2Lb7W60C20o5s6sBFq1BqYf50Ea7bnh4AUtt3Nt8U4HBKlA58V70XwQ4E9n7SHsNbNnvlzgE_1FUNIShY75pd_2yqMHj7NwwDc8G6V4OT-7YMRuUWlbi1gWKP3wLyI3yK36vvdYD4KGvPBsaiVxsBBwGe-HJtCyqmzSFCxq1a_FuHCrkWzlAczApTw2qnjsZdrLO3fbJ0FAaeohQ_DjsaLOWYXsD9OhAEsmmD_NFjT_1xC1Vz_YrJkEWfFyy1xTPnMBirypRVonmVYZgpJGaUeOWxLkujIFf18H4gytASnp5dK_ITmtSHW-wGTmzolpcYDW4hOx8rnhSFUIZpp5d1UvBlPPhyyTBWDeoTBrdrlLy0gXKKbqYbdsnH0Ohox_jgw7zXrd9Fc-T4L4lY4WT0NT4Di74KlPtPAdgkuvJiA5i7E8DQU

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK j-7164313-4200646.js Show response
cdn.flashtalking.com/xre/716/7164313/4200646/js/ Frame F4AE 84 KB
21 KB 107ms
40ms Script
text/javascript 104.76.104.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/xre/716/7164313/4200646/js/j-7164313-4200646.js
Requested by: Host: servedby.flashtalking.com
URL: https://servedby.flashtalking.com/imp/1/202177;7164313;201;js;DV360;RotmanJan2023ExecutiveLeadershipProgram728x90/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231011%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-1-%26adk%3D1812271801%26client%3Dca-pub-5952306940031097%26fa%3D1%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26xpc%3DgZt65dIvsr%26p%3Dhttps%253A%2F%2Ffontesk.com&gdpr=&gdpr_consent=&us_privacy=${US_PRIVACY}&cachebuster=102148.46193013227
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.76.104.56 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-104-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: 9924dafc5fc51aee726ebaacf7355191bd5d2d74eff18f7ae0ce57903ff12cd2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Sun, 15 Oct 2023 22:37:51 GMT
Content-Encoding: gzip
Last-Modified: Wed, 01 Feb 2023 12:24:20 GMT
Server: Flashtalking (AKA)
ETag: W/"bc22d85a3c5444de0d49c9eda895adf7"
X-FT-Origin: us
Vary: Accept-Encoding
X-Varnish: 738082127
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 20727
Expires: Sun, 15 Oct 2023 22:57:51 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD04 0
20 B 46ms
45ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BBu0pvmksZb6zBebUoPwPupWNwAkAAAAAOAHgBAI&bg=!_P-l_7DNAAYMG8UMLBs7ADQBe5WfOAKTGZntFcZS8vZNRYovF1HVZbAh79qtO35vY3u2TyWD15VE_vk1uNQ-KD_dI3xmAgAAAR9SAAAACGgBBwoADE7DHKIjeGVRkFb6n5kC9eGJ7yhc9_G-D15GG5L7FpFoZouVnhIJZnwVDUb7Bo_3JqBVu2QyDATFEtaFR-MIT6Hhc-42sCE8S8MMRNLDqysLb49OO5p6QsR8OmbaqpFIgZT6Aw_WtVhFv7dEgRZZXApzboyh4H6SM-O-6jcM_Lrp8vuL_rm58PjK8uagu2LtthQywVHOZnbn0_qGw38DNE-k2t_TnnWDvmV0Fm-DTFmbUzr35OrY-eO6Toc-C3lJHtOIudygquTkk2iJ7OUfCNjL35pm6fOzqwlCQ8SW4PMrja3NwP9GY3FUzrJfNKzDMlAC-Z-Ze_Keb6W-pbTck43TridJCQyfNAqNRM62d2bSLyZbdJvuJpCEmADorL9O3dNxKUoJyzruMwC5nQ8KRFnRlacfapW6UM1ExrL5jSjfhdpu5MPa5qBxNe9Ma6bzPM1YwW5IYfxev-WRWU3d45EP8NkmiGUovO6monqQWQZdxdBgy-sNtjU8cxQk6Fji7EZzsfWdvFbRZW_f2olDBF3Mo-K356n76vFWPeDIUsb2kdzt6oAxWMn2fmtJV1wgVkKp5_cpL6bgLEPqlOPsQ-s6GTvGXqxN12z9wt0wLBvLiQSm4-S2ETcdkO2vnWeSuz53N7mERAxf2tkFasx_oLwF_MkgzrJZruxw9zrWJgnlSUBkDK-hgUkw6Imri4-eiU4p_yqxg1rSX8kAzm4iLMTgUkJIVb3n4joz-iJdwMuvCQUVsJ3aPc0pw0MU5WgwmA-zE8J-Qi4IH2rrr7yiHrChkuiHY_PfrhJB33JGFL7WX325kfyvzM-CCTLy5fSbHJxTtbxSyvpTqbp5cqawOGna60Tnephxg-AtgDDdYhK18ayHuZruRzPLs2ldEq55Bq9jPdMbGj1L_lNwEv0X_kCypE5PLsT3pjGVMPiM01Z7mx5cfbs3YgDj-WPfOS-o21To3ObNY1_6qCHubG0OJinu0Vt23KeLiaQSB-D4nnX8ZPC6pi3bXMzG1Hb6RDozRQkiwsA

Requested by

Host: fontesk.com
URL: https://fontesk.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js Show response
pagead2.googlesyndication.com/bg/ Frame 8331 38 KB
14 KB 31ms
31ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

sffe /

Resource Hash

6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 06:12:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 231902
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 12 Oct 2024 06:12:49 GMT

GET
H/1.1 200
OK main.html Show response
cdn.flashtalking.com/172384/4200646/ Frame 123E 46 KB
9 KB 38ms
38ms Document
text/html 104.76.104.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/172384/4200646/main.html
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/716/7164313/4200646/js/j-7164313-4200646.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.76.104.56 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-104-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: 543c9a55d000f237f2908286f57209373c7863687dc8c91cc6586c01428a9097

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Access-Control-Max-Age: 3000
Cache-Control: max-age=1200
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 8123
Content-Type: text/html
Date: Sun, 15 Oct 2023 22:37:51 GMT
ETag: W/"1bc228b3142ace4deb520a97d484b2ab"
Expires: Sun, 15 Oct 2023 22:57:51 GMT
Last-Modified: Fri, 27 Jan 2023 11:31:45 GMT
Server: Flashtalking (AKA)
Vary: Accept-Encoding
X-FT-Origin: us
X-Varnish: 833935289 833515888

GET
DATA 200
OK truncated
/ Frame F4AE 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d628acb31a172a47e61e0a8f479bfa080ca695b882aec44c07545d96ac912202

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 593ed8_8fa92a7bb7278b25.js Show response
adstudio-asset-lib.flashtalking.com/live/shared_libraries/ Frame 123E 403 KB
104 KB 117ms
32ms Script
application/javascript 54.192.51.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://adstudio-asset-lib.flashtalking.com/live/shared_libraries/593ed8_8fa92a7bb7278b25.js
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/172384/4200646/main.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-80.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 923c7b157bd36e8b18040eef8ef6c7984c3f0585122973c2d12335b894efe44c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cdn.flashtalking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 01:37:47 GMT
content-encoding: gzip
via: 1.1 c83536c4e12f4a229fa27266fc5fdd56.cloudfront.net (CloudFront)
last-modified: Thu, 26 Jan 2023 15:28:29 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-C2
age: 75605
x-amz-server-side-encryption: AES256
etag: W/"dc912103896ceff818af13abd4d9f36d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: Aawa6U1pBfDt1GvRX0zh4nK0vFX8emp5oTMWRbJD8GcBmm5yghIGWQ==

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 7990
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=ChZ2kvWksZaDgBMT3xtYPutmOSMGNnrVz2IrFm-0Q3eurr94BEAEg5ealb2D96KKB8AOgAfCttbcDyAECqAMByAPJBKoE1gFP0AghBen9mYsqpW1CFsn-_HAnwJCnGtFufmYLeNwFXBt6z3C...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x13233caa5bf444b90000000000000000%22,%222%22:%220x7340d059dfc968e50000000000000000%22,%223%22:%220xe89f08...

0
0

156ms
89ms

Fetch
text/css

172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x13233caa5bf444b90000000000000000%22,%222%22:%220x7340d059dfc968e50000000000000000%22,%223%22:%220xe89f0832f88de9e0000000000000000%22,%224%22:%220xb6da75fa197e92f90000000000000000%22,%225%22:%220x76659f0feb84670e0000000000000000%22},%22debug_key%22:%2211564254067326906306%22,%22debug_reporting%22:true,%22destination%22:%22https://envato.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22921523952%22],%224%22:[%2210-15%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2210309910352839377713%22}&andc=true

Protocol

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:51 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x13233caa5bf444b90000000000000000","2":"0x7340d059dfc968e50000000000000000","3":"0xe89f0832f88de9e0000000000000000","4":"0xb6da75fa197e92f90000000000000000","5":"0x76659f0feb84670e0000000000000000"},"debug_key":"11564254067326906306","debug_reporting":true,"destination":"https://envato.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["921523952"],"4":["10-15"],"6":["true"]},"priority":"500","source_event_id":"10309910352839377713"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 15 Oct 2023 22:37:51 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 15 Oct 2023 22:37:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x13233caa5bf444b90000000000000000","2":"0x7340d059dfc968e50000000000000000","3":"0xe89f0832f88de9e0000000000000000","4":"0xb6da75fa197e92f90000000000000000","5":"0x76659f0feb84670e0000000000000000"},"debug_key":"11564254067326906306","debug_reporting":true,"destination":"https://envato.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["921523952"],"4":["10-15"],"6":["true"]},"priority":"500","source_event_id":"10309910352839377713"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js Show response
pagead2.googlesyndication.com/bg/ Frame 37DB 38 KB
14 KB 33ms
33ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

sffe /

Resource Hash

6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 06:12:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 231902
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 12 Oct 2024 06:12:49 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8331 0
20 B 50ms
50ms Image
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BTFGCvmksZfKlLdyVoPMPr-OD6AIAAAAAOAHgBAI&bg=!b2ylbCPNAAYMG8UMLBs7ADQBe5WfOPk2D0w_hkbkZ96vG1hh_HhikWwirJ_9LGBxiC_V0SJc99-vns_LDX-Q_gq8aPXiAgAAAMlSAAAAB2gBB5kC8cXb7ClsQB_oXjFkB7LlKheRPawNd5bH-dL87jGownJgHVm6TlXDrmARLEVqFxKf6G-oqUinO-PuX5rJwh7hGPRdqADXvPM2HlEu7Ph7iLTSoLpqf8h2Ouanxw8deNFwfT2MzS8MT3ylsUC0JZbtWinsZnuvh7i0Ki0yW2cex9yfBECWSgstK28e_7hRHRJfCAg--mgAZOi_DPc-i4Oqjyz4uVWvDoD9K-Is4U4ZNEXrisX4w0JPYZHWjj7nybK2yUXKLY6XnXF7JZwLpFIULPR_p30H86qR7GnRk3_WLvR0DQS19gMIS4JAZtfaPEqSaAuwd8kgBUKkwVLEgqJiVQ8WRt0MWlHFh5oJULa3Vra7tn8npP60QuHoWigc_-Pz-svhqEJWeWRMo5ZH7e-v4E0DKJ1hJapxF7xMtG_3wWn4YuwPR7WcATLkJqkaHzK-Jdwjc2JUsrL5gIUioxAmlTBjYubqlVeizk_YIoUyePECGwbI9YjwOSeCf0QuPcF5PhQZgEu8x4i8qHgL4wBwknfgiiRc_EmnSWpuPZ0DVMwhi3EV16J0Z4Ym0XTyy1Wn5PoAmYfiMm5Ar55IwbdVyS-wD1-QsQVpzLFV31--SgBlVU0GB40GUup3c8p4mM6ipsNtJDeOYJlMOcptQN1wvopH65GjHXCIb4DecC7zov8G9nWKOy3c66FM0wqWnL3avWdCQNNH1U-iDjK9xogpydaW4QHf0i772urRlE3PNl_qBEb-7rvVRGD1C9aGPV4cnHrndsynSRAZttpMEwCTsHOmcfc_5m9PDC5bRrKtXMxET3TsKQKJ-IkyekA7cIZLRqhdaPXswAD4zBueJRbya2g1tx1EgYq9OX1AOATq9nxKagRauuTeYvoyiJyREQz9TtYCLS-8tVKZaaSqx-nXvitg9OVratkQ7bUg5ii4mmbD8nMEemYIrwyigb2pgv4J9DPrOhcYMMnTt1RYUkNrxjHPZZIzCW0duXfFfRQCMK6pUQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231011/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 63FF 42 B
174 B 94ms
94ms Fetch
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssg2t3Wrc6C8ZffWIXKAGzw-WSmQW16sDJ12aFdfqBDEhIe2XTTD8TByLVMvRb6tqoGlQt2SAPgHdXnOEU_X66R2eeXewoO2eYc-3qAz59go_ikxmESHIwe4MXX8b36swUbVEkzDzWdEA&sai=AMfl-YRljFTjcvrl-quh9XWIciB0UEBhw2d_6eBi41OCSIbGpwm-pknGUtPsVjmrcztIGpXZw98ghGHBRKmWpcek3ADjdXznqKHHI8zaFBILD5LgOvFeshbqqx6S0dM4fnrTbHdNthmwiZbxVx8JIQ&sig=Cg0ArKJSzNMetmOX_81DEAE&cid=CAQSTADICaaNH-MFU4TFQU8CT7yaiNMSxDHbGI-07vdaP7mJu4GoojcI4z6jaRtMTHMUhxr0_epc6oOhcCg30scWKPpnu4KNmhajzyaxZLEYAQ&id=lidar2&mcvt=1008&p=0,0,90,728&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3956400729&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697409469851&rpt=423&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5105 0
20 B 45ms
45ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4117938219453&version=m202309260101&ct=76&x=1&cor=15033693941344100000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 48ms
48ms XHR
application/json 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231011&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

fa1a995b616d95bab627298ed75f2c4985633feabc84a0aa635b242dab18c295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12236
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5944 0
20 B 45ms
45ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8668610616940&version=m202309260101&ct=76&x=1&cor=17534240720175229000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 154ms
88ms Preflight
text/html 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 15 Oct 2023 22:37:51 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 32ms
32ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310100101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 15 Oct 2023 22:37:51 GMT

GET
H2 200 genesis-1-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 127 KB
126 KB 26ms
25ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/genesis-1-590x332.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 4b82c56bc4cbc34033b250b03db2a19c148069c2d89872f0005efacb47560292

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
last-modified: Thu, 12 Oct 2023 07:23:08 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H2 200 quartech-1-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 118 KB
118 KB 23ms
23ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/quartech-1-590x332.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 37c1ad422302a6b0082e02df9a0704f8e78156edaa378fd3d0e43468fe3e08de

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 09:46:48 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H2 200 flicking-1-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 148 KB
148 KB 30ms
29ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/flicking-1-590x332.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: 5073a7c4afba7e884cb28b46a1e11a716953f9a5e759589f259b67c5234ccae0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 09:38:42 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H/1.1 200
OK AvenirNextLTProBoldwoff.woff
cdn.flashtalking.com/172384/4200646/assets/live/studio/assets/2658920/original/ Frame 123E 37 KB
38 KB 32ms
31ms Font
font/woff 104.76.104.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/172384/4200646/assets/live/studio/assets/2658920/original/AvenirNextLTProBoldwoff.woff
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.76.104.56 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-104-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: 1c3a28f09c658fbab4c84aa58010f2f86c2c2ae49e95dd40828d51f3f4e26d9b

Request headers

Referer: https://cdn.flashtalking.com/172384/4200646/main.html
Origin: https://cdn.flashtalking.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Sun, 15 Oct 2023 22:37:51 GMT
X-FT-Origin: us
Connection: keep-alive
Content-Length: 38344
Last-Modified: Fri, 27 Jan 2023 11:31:44 GMT
Server: Flashtalking (AKA)
ETag: W/"ed344d06e4add3e42018414d7c91e1c9"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET
X-Varnish: 530129877 523906438
Access-Control-Allow-Origin: *
Content-Type: font/woff
Cache-Control: max-age=68482
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: Content-Range
Accept-Ranges: bytes
Access-Control-Allow-Headers: Range
Expires: Mon, 16 Oct 2023 17:39:13 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 269A 13 KB
5 KB 32ms
30ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 274637
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 12 Oct 2023 18:20:34 GMT
expires: Fri, 11 Oct 2024 18:20:34 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4F43 829 B
1001 B 48ms
47ms Document
text/html 142.251.163.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f99.1e100.net

Software

GSE /

Resource Hash

ad0433539e1a76d42c6dd403cd6fed2a0776292d83a21d56e895304f7fce9a3e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KZ4EXQEpnVzmDjNpx-DL5A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://fontesk.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-KZ4EXQEpnVzmDjNpx-DL5A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 22:37:51 GMT
expires: Sun, 15 Oct 2023 22:37:51 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK html5API.js Show response
cdn.flashtalking.com/frameworks/js/api/2/10/ Frame 123E 89 KB
28 KB 35ms
34ms Script
application/javascript 104.76.104.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/frameworks/js/api/2/10/html5API.js
Requested by: Host: adstudio-asset-lib.flashtalking.com
URL: https://adstudio-asset-lib.flashtalking.com/live/shared_libraries/593ed8_8fa92a7bb7278b25.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.76.104.56 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-104-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: 919664d4c088d6963c5c872ced7e8859a3cabc2cec3ef42f4afa99de7a3321da

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cdn.flashtalking.com/172384/4200646/main.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Sun, 15 Oct 2023 22:37:51 GMT
Content-Encoding: gzip
Last-Modified: Thu, 31 Aug 2023 15:23:45 GMT
Server: Flashtalking (AKA)
ETag: W/"aa5cfa970907192576fba68520d94a44"
X-FT-Origin: us
Vary: Accept-Encoding
X-Varnish: 797058713 768215352
Content-Type: application/javascript
Cache-Control: max-age=62049
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 28723
Expires: Mon, 16 Oct 2023 15:52:00 GMT

GET
H3 200 4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js Show response
pagead2.googlesyndication.com/bg/ Frame 269A 37 KB
14 KB 33ms
32ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

sffe /

Resource Hash

e102462cd94a7e7573dd74233c5f56d3770f732649a2b1d3eff05775d082b013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 06:52:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 229551
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14648
x-xss-protection: 0
last-modified: Tue, 10 Oct 2023 07:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 12 Oct 2024 06:52:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4F43 0
0 90ms
89ms Image
text/html 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231011&jk=1307067186117376&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.111.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bk-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H2 200 quirky_clarendon-5-590x332.jpg
fontesk.com/wp-content/uploads/2023/10/ 74 KB
71 KB 24ms
23ms Image
image/jpeg 209.16.158.135
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fontesk.com/wp-content/uploads/2023/10/quirky_clarendon-5-590x332.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.16.158.135 , Canada, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: hybrid4002.ca.ns.planethoster.net
Software: Apache /
Resource Hash: c9c28c896f747e79d0ea3b0c58dc4de3eca6379087856f360d260f146ac1f7c1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:50 GMT
content-encoding: gzip
last-modified: Thu, 12 Oct 2023 07:31:28 GMT
server: Apache
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
expires: Mon, 14 Oct 2024 22:37:50 GMT

GET
H/1.1 200
OK manifest.js Show response
cdn.flashtalking.com/172384/4200646/ Frame 123E 792 B
1 KB 44ms
44ms Script
application/javascript 104.76.104.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/172384/4200646/manifest.js
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/frameworks/js/api/2/10/html5API.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.76.104.56 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-104-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: 5e2ae1df29c8b0c4b986b2d7affafe25e35bb6eaf8a90bb751eea4639edeaeb5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cdn.flashtalking.com/172384/4200646/main.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Sun, 15 Oct 2023 22:37:51 GMT
X-FT-Origin: us
Connection: keep-alive
Content-Length: 792
Last-Modified: Fri, 27 Jan 2023 11:31:45 GMT
Server: Flashtalking (AKA)
ETag: W/"87b77c54ba662d5eaf7627706aedb543"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
X-Varnish: 346993493
Accept-Ranges: bytes
Expires: Sun, 15 Oct 2023 22:57:51 GMT

GET
H/1.1 200
OK Tracker.js Show response
cdn.flashtalking.com/feeds/frameworks/js/utils/ Frame 123E 7 KB
2 KB 27ms
27ms Script
text/javascript 104.76.104.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/feeds/frameworks/js/utils/Tracker.js
Requested by: Host: adstudio-asset-lib.flashtalking.com
URL: https://adstudio-asset-lib.flashtalking.com/live/shared_libraries/593ed8_8fa92a7bb7278b25.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.76.104.56 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-104-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: 4c177e4e7d46fc0cd191cfd21e1d4fb24229e5c03e491cec02b6a4cd1c459ded

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cdn.flashtalking.com/172384/4200646/main.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Sun, 15 Oct 2023 22:37:51 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 Oct 2017 20:49:54 GMT
Server: Flashtalking (AKA)
ETag: W/"dd0371837f9bb02ffb72b212c849f4d8"
X-FT-Origin: us
Vary: Accept-Encoding
X-Varnish: 868842240 868021925
Content-Type: text/javascript
Cache-Control: max-age=860
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1816
Expires: Sun, 15 Oct 2023 22:52:11 GMT

GET
H/1.1 200
OK mv29424983.json Show response
cdn.flashtalking.com/172384/ Frame 123E 1 KB
1 KB 64ms
37ms XHR
application/json 104.76.104.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/172384/mv29424983.json?cb=358201645
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/frameworks/js/api/2/10/html5API.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.76.104.56 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-104-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: 52f43d412e17ca98125db572a57f219315f41d780aa235d35b76aab5bdcb4d8b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cdn.flashtalking.com/172384/4200646/main.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Sun, 15 Oct 2023 22:37:51 GMT
Content-Encoding: gzip
x-amz-meta-creative-id: 4200646
x-amz-meta-creative-library-id: 172384
X-FT-Origin: us
Connection: keep-alive
Content-Length: 425
Last-Modified: Fri, 27 Jan 2023 11:31:45 GMT
Server: Flashtalking (AKA)
ETag: W/"cf74a4a9a0131c93e806451d7e0b0792"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/json
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Vary: Accept-Encoding
Cache-Control: max-age=1200
X-Varnish: 455229229
x-amz-meta-ad-type: HTML_onpage
x-amz-meta-version-id: 29424983
Accept-Ranges: bytes
Expires: Sun, 15 Oct 2023 22:57:51 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 269A 0
10 B 31ms
30ms Image
text/plain 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?RM9xbw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.163.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:51 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1 200
OK Rotman_Dynamic_Banners_728x90_RotmanDynamicBanners728x90Logo.png
cdn.flashtalking.com/172384/instantAssets/ Frame 123E 3 KB
3 KB 30ms
29ms Image
image/png 104.76.104.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/172384/instantAssets/Rotman_Dynamic_Banners_728x90_RotmanDynamicBanners728x90Logo.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.76.104.56 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-104-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: be944f929181b5de70d2b8323e5b606ddaf45da2b38f1ca0103977fca4bb930e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cdn.flashtalking.com/172384/4200646/main.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Sun, 15 Oct 2023 22:37:51 GMT
X-FT-Origin: us
Connection: keep-alive
Content-Length: 2895
Last-Modified: Fri, 27 Jan 2023 11:33:06 GMT
Server: Flashtalking (AKA)
ETag: W/"e46781e3db4dabf40700d67ab51fce4f"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
X-Varnish: 692073540
Accept-Ranges: bytes
Expires: Sun, 15 Oct 2023 22:57:51 GMT

GET
H/1.1 200
OK RotmanDynamicBanners728x90Background.png
cdn.flashtalking.com/172384/4200646/assets/live/studio/assets/2647019/original/ Frame 123E 1 KB
2 KB 31ms
31ms Image
image/png 104.76.104.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/172384/4200646/assets/live/studio/assets/2647019/original/RotmanDynamicBanners728x90Background.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.76.104.56 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-104-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: bb5786988eb66624cda0e923e32b40ba3af7d7b8c32f231d5f71f0b99c3b70ca

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cdn.flashtalking.com/172384/4200646/main.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Sun, 15 Oct 2023 22:37:51 GMT
X-FT-Origin: us
Connection: keep-alive
Content-Length: 1067
Last-Modified: Fri, 27 Jan 2023 11:31:44 GMT
Server: Flashtalking (AKA)
ETag: W/"a0c4c1bb046955c664169c8eefaeca90"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
X-Varnish: 269597880
Accept-Ranges: bytes
Expires: Sun, 15 Oct 2023 22:57:51 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 63FF 0
20 B 44ms
44ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=706260665766&version=m202309260101&ct=76&x=1&cor=1471633618171313400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 47ms
46ms Image
image/gif 172.253.115.101
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=7.922704059102794

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-tEEFvOz8sATv6GZHYdYkXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:51 GMT
content-security-policy: script-src 'report-sample' 'nonce-tEEFvOz8sATv6GZHYdYkXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 50ms
49ms Image
image/gif 172.253.115.101
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=0.6553312903230613

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-Bk2sjlFNP5-jXJZnpONIBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:51 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-Bk2sjlFNP5-jXJZnpONIBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK Rotman_Dynamic_Banners_728x90_RotmanDynamicBanners728x90Logo.png
cdn.flashtalking.com/172384/instantAssets/ Frame 123E 3 KB
3 KB 27ms
27ms Image
image/png 104.76.104.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/172384/instantAssets/Rotman_Dynamic_Banners_728x90_RotmanDynamicBanners728x90Logo.png
Requested by: Host: adstudio-asset-lib.flashtalking.com
URL: https://adstudio-asset-lib.flashtalking.com/live/shared_libraries/593ed8_8fa92a7bb7278b25.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.76.104.56 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-104-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: be944f929181b5de70d2b8323e5b606ddaf45da2b38f1ca0103977fca4bb930e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cdn.flashtalking.com/172384/4200646/main.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Sun, 15 Oct 2023 22:37:51 GMT
X-FT-Origin: us
Connection: keep-alive
Content-Length: 2895
Last-Modified: Fri, 27 Jan 2023 11:33:06 GMT
Server: Flashtalking (AKA)
ETag: W/"e46781e3db4dabf40700d67ab51fce4f"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
X-Varnish: 692073540
Accept-Ranges: bytes
Expires: Sun, 15 Oct 2023 22:57:51 GMT

POST
H3 204 AGSKWxXaJYKfIszATCIgIuG5WNVt1FYOyWRZr--KzjryC_blnxG1NmfoGLr2GX64CGuSR6dUUIf9KFFGOJMcRV7P6JBvmw3WyjS8O573PknSvP8OcrmoY_J_tkLgEeDZe1b0DEr49xvJxA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 107ms
47ms XHR
text/html 172.253.115.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXaJYKfIszATCIgIuG5WNVt1FYOyWRZr--KzjryC_blnxG1NmfoGLr2GX64CGuSR6dUUIf9KFFGOJMcRV7P6JBvmw3WyjS8O573PknSvP8OcrmoY_J_tkLgEeDZe1b0DEr49xvJxA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-E9HxskEl2Ht0kHv2gmW7Rg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 15 Oct 2023 22:37:51 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-E9HxskEl2Ht0kHv2gmW7Rg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://fontesk.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F4AE 42 B
64 B 89ms
88ms Fetch
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsufnIZoxdvJwegT4ITobA_NpaW6W3ySzdsK2nnXUC9jNZFhg0gM2s6NCAtDOjb9_988paHnU_pJwqDQQhppRCjEWyBdSdx2YRFltEPcExdYX5NCvgalw825ywp_nFEtxlyfioEBVGrNOQ&sai=AMfl-YR--HWR9tPO_3xZ0gh1_XxOj9WthogbpL1aZ1nWJBiucvlV-pmxBgdfGT1Vox2uKgs_mUWTJpI2S82jO3hIhyyqFw32eSgE8LSlnJ9ajtv74GseWPGDHDIVDFbycUi4xpn34KHQ5kkmLrG4fw&sig=Cg0ArKJSzFCXKxQd6zzAEAE&cid=CAQSTADICaaNBGHf346gWOuOb9Pa2aKku1MIALuaQ0k-SZqCWC1jbI1FQh1sB4jQrvTBcXMV2Dl-PG5ltZIg6CrD-gWP-6EModdDrxxcqA0YAQ&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=729,1000,1000,1000,1000&tos=729,271,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697409470549&rpt=639&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7990 42 B
64 B 89ms
88ms Fetch
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuEBAJCUX7xVlgUt5_5_jwiKY-bM-0TsVWITieXVeux8cCHp_7orW3bYme5REyBBOiKfeujEZEdYhbKtA1en7hPBrPWPmbwslmfBTIBTLheAC-hfGH1uayFiAf31M2PGnJTa660VxodcA&sai=AMfl-YQVlnur8-rzLnt-7gXvwIzXjncem0XuigMHykEmUoo-V8yJU7FKm735Mvfgth5Sx0DO0ob8VW_E017c5QulYuDn3DdX7EAL9wzI88y-eOKH_uTqVMfwvpgmIEfRQv4LsNTKwIuLazmV6RdkEQ&sig=Cg0ArKJSzGmrcYOJn6BTEAE&cid=CAQSTADICaaNYS6byc6dNX-XJKmtiF7Z1mxsv4QejT6LLrdk5ALTR5qXLbZIcZPlD12lA_ylHIfyWoMTuyr7OTWxfu9u1zXmGtwkwrYmh8YYAQ&id=lidar2&mcvt=1000&p=0,236,90,964&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=525839248&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697409469037&rpt=2188&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 87ms
87ms Image
text/html 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231011&jk=1307067186117376&bg=!t7SltPvNAAbFpEfJ5aQ7ADQBe5WfOAJvlEfbqgklVXHTl-KodecOXOkYQeRiLWTHbKB6Vawgx-2s-XXRpSLHOnRgsvZzAgAAALRSAAAAB2gBB5kDAKXYcJET1jBBbT711b4xtQldIpoDM6v-ILc7obXoIxgKiic09C7f4MlMonn6RvUqGbX8yihCeDPg1gsKUIk0rjL_5q0ajBpXt7Kr1yAmNcl2eDQTH3ST7goSlWyqKKv52OSk5c0GVb8aJf4Dno1k5wrYdMNZMi42UJOUBT626S9tAh5CJNSLxDyV-Nd0xFPNYHxhU63eYpTSurzjcCyKmRD7hYM1I8baEcCUguCNKavmgOxTGmBHp5x8zJB0dnW0aNlK4rIK_G5wwVgX9AdZly-jIiZOPuINlKavSKlLzUK-7bVnLMDzqN06axsoSunoA54tjPtUL6e34Un7GKtPFpJFbBViibsJaor84tcdNFR1aADl0byyiB_eNxVLAdkETUdCIcidySRpl8kNc4Jj0omAKt5rftiJgIlygUYmIoglxhkWW97ZWlW8f0lIrNEASMSym1QL3jE3hJOSbkPvVFSiaICMkbICLNMityuvvdLa99j0-04FWYaXmFerv6WndxLRhCDGZMmonAHkIFyaYwdnmgL2llFQQ_UMZqfJTtzwCrIq0_vxVo5er096Dj6GODvgRix0Jwl3xjkZYiAe5qez7ukhtDWUcIrPoyMWIRYif1Ktyiu4fiffZqRB2k7trR5eWCkQDxQCUh8HqsVuEh5strcS6E7ok2J5xk_KcB7h0QiaDAnZLxqYE_nbsqdqhNXfLerAczQT1zZxVXSrQ-uuOQBqmSAwz6Ca63OWKAbb66qWIK8ROr6KmG4EhwviG-tXuoJnHgfV5gzCLMO4gk4gZRnAOe5K6yzF34EgQxuQxKs4OJfeGn9qkd1OmC9HMtzwcU_fFOmGW4ZciD4l-ohLPlvwZfQjxMzl5sw7itqpw1MuO6G1naIQzZTf7FY840mUoKQ51z4XwdtKCsMigY-rBALXkuK0qrgBswnHwzr2Y16UkWYxyI2E5R2wvWP9DRHDhoi383Zr-JwQo-0oOBbrZGXdgatzM-A9s3qzo-wBHgmlFJkWvtVSrGvjvxhGuQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.111.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bk-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4AE 0
20 B 45ms
44ms Ping
image/gif 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=840869453832&version=m202309260101&ct=77&x=1&cor=11075836978485664000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Oct 2023 22:37:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 _-rightrailad-728x90.php Show response
fundingchoicesmessages.google.com/f/AGSKWxUXCvDayPCucGanjRvLlCR6QqfRrkH3POaCLAldJE9SxT6z6seLAgQ69Srv5PtA73yCREj12SHIIH0El5CLUaKXb8vJunzIuwsUSrSZjDu6E0np59MrRIvh7tQ3UWiEtzJiDCLfGk-62zgyUkbpcP-a53-tR... 54 B
109 B 50ms
48ms Script
application/javascript 172.253.115.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUXCvDayPCucGanjRvLlCR6QqfRrkH3POaCLAldJE9SxT6z6seLAgQ69Srv5PtA73yCREj12SHIIH0El5CLUaKXb8vJunzIuwsUSrSZjDu6E0np59MrRIvh7tQ3UWiEtzJiDCLfGk-62zgyUkbpcP-a53-tR9nBSFscYpZuc0l4Nq9BAzffYOWT9XZ3/_-rightrailad-728x90.php?.lazyad-/adbureau./ifolder-ads.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.5YUTrEgx1G4.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwXCWVhy_SU_JAhez8qvQEgZ64ckg/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

bef9bb259e6addb554532ad5a02e5d96ce6731e8f0e26524d7b18ddc7f0e3353

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BVG6khTYGukKlD_GJKmOAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:52 GMT
content-security-policy: script-src 'report-sample' 'nonce-BVG6khTYGukKlD_GJKmOAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ 61 B
76 B 32ms
30ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

c45c8b81ccfcbc08127b74787d1b5974078756233de947986c357e28ed8f13ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 21:39:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3513
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51
x-xss-protection: 0
server: cafe
etag: 16023549773543154165
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Sun, 15 Oct 2023 22:39:19 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXaJYKfIszATCIgIuG5WNVt1FYOyWRZr--KzjryC_blnxG1NmfoGLr2GX64CGuSR6dUUIf9KFFGOJMcRV7P6JBvmw3WyjS8O573PknSvP8OcrmoY_J_tkLgEeDZe1b0DEr49xvJxA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-6KWtaFML21-ZPUTDO8J2cg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 15 Oct 2023 22:37:52 GMT
content-security-policy: script-src 'report-sample' 'nonce-6KWtaFML21-ZPUTDO8J2cg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://fontesk.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXaJYKfIszATCIgIuG5WNVt1FYOyWRZr--KzjryC_blnxG1NmfoGLr2GX64CGuSR6dUUIf9KFFGOJMcRV7P6JBvmw3WyjS8O573PknSvP8OcrmoY_J_tkLgEeDZe1b0DEr49xvJxA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-8CMB9r6Dm7yo2M7kSkGuAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 15 Oct 2023 22:37:52 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-8CMB9r6Dm7yo2M7kSkGuAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://fontesk.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXaJYKfIszATCIgIuG5WNVt1FYOyWRZr--KzjryC_blnxG1NmfoGLr2GX64CGuSR6dUUIf9KFFGOJMcRV7P6JBvmw3WyjS8O573PknSvP8OcrmoY_J_tkLgEeDZe1b0DEr49xvJxA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-xaVttvk-V3nZgPZiDpV14Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 15 Oct 2023 22:37:52 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-xaVttvk-V3nZgPZiDpV14Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://fontesk.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXaJYKfIszATCIgIuG5WNVt1FYOyWRZr--KzjryC_blnxG1NmfoGLr2GX64CGuSR6dUUIf9KFFGOJMcRV7P6JBvmw3WyjS8O573PknSvP8OcrmoY_J_tkLgEeDZe1b0DEr49xvJxA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-u-IozCItQ0vrpozQkIKydw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 15 Oct 2023 22:37:52 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-u-IozCItQ0vrpozQkIKydw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://fontesk.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxWGZkNcXLlwjSXzvJuem9saur4KFIXgtSG1sKGZpssp6FqcD6M-fdpIanejrtinvixDke-CAWRrs5n3h0mINzA7uRVWcph4t69uIdZxzFg7opnTy5jOIT4TrhtTexIm_RH55G-c0Q== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 64ms
63ms Script
application/javascript 172.253.115.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWGZkNcXLlwjSXzvJuem9saur4KFIXgtSG1sKGZpssp6FqcD6M-fdpIanejrtinvixDke-CAWRrs5n3h0mINzA7uRVWcph4t69uIdZxzFg7opnTy5jOIT4TrhtTexIm_RH55G-c0Q==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk3NDA5NDcyLDU1OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9mb250ZXNrLmNvbS8iLG51bGwsW1s4LCI1WVVUckVneDFHNCJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

5b4107bf5bcb1319c0eb3c9d3b5f8d4d96dbad45303f746260ac376888cf595e

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-vBEZ0YuSxDVVBRO5d4iihQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://fontesk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 22:37:52 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-vBEZ0YuSxDVVBRO5d4iihQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVHYnVap3KUDSPtZgcAAMpfJygtc8lBRBxpsDU_nLJvskiTgiM0lRjzDh1Otq75ML1lWwRMswOhNPLgj-QYv5PCLFr3JOhNMJrXI-a8xNQKWKs7r6i1d1b-eJqeMAc5L7mT9Hc5pQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 47ms
47ms XHR
text/html 172.253.115.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVHYnVap3KUDSPtZgcAAMpfJygtc8lBRBxpsDU_nLJvskiTgiM0lRjzDh1Otq75ML1lWwRMswOhNPLgj-QYv5PCLFr3JOhNMJrXI-a8xNQKWKs7r6i1d1b-eJqeMAc5L7mT9Hc5pQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-JqXrTdajAU1Mj6eABWbdVQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 15 Oct 2023 22:37:52 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-JqXrTdajAU1Mj6eABWbdVQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://fontesk.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXaJYKfIszATCIgIuG5WNVt1FYOyWRZr--KzjryC_blnxG1NmfoGLr2GX64CGuSR6dUUIf9KFFGOJMcRV7P6JBvmw3WyjS8O573PknSvP8OcrmoY_J_tkLgEeDZe1b0DEr49xvJxA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ptbg25cGyvke3L-zVt2Glw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fontesk.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 15 Oct 2023 22:37:52 GMT
content-security-policy: script-src 'report-sample' 'nonce-ptbg25cGyvke3L-zVt2Glw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://fontesk.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

77 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.fontesk.com/	1970-01-21 01:06:09	Name: _ga Value: GA1.1.2063783378.1697409469
.doubleclick.net/	1970-01-21 01:06:09	Name: IDE Value: AHWqTUkGWJseIKQvRKOAqJei8IMonLYwS__ammZJ0CqgX-OUt2X1TOFBuDauVMWw
.casalemedia.com/	1970-01-20 17:39:45	Name: CMPS Value: 1421
.adnxs.com/	1970-01-20 17:39:45	Name: uuid2 Value: 4745288701025259079
.doubleclick.net/	1970-01-20 19:49:21	Name: APC Value: AfxxVi6nGS5iYEihDWFzGJPeein7cVeyttjmSRzmXA8dQVSAQZbeRQ
.casalemedia.com/	1970-01-21 00:15:45	Name: CMID Value: ZSxpvVKszJGxHorv4SUS.QAA
.casalemedia.com/	1970-01-20 17:39:45	Name: CMPRO Value: 1244
.adnxs.com/	1970-01-20 17:39:45	Name: anj Value: dTM7k!M41.D>6NRF']wIg2Ilhl$Kck!]tbp8i_iqf!oN/@E'zz<Z0QUWeZ(Hw`p:R#ViVas]21(9UucjkX4UX+)]TD._*PlZ[C[-kX-JAj?-
.fontesk.com/	1970-01-21 00:51:45	Name: __gads Value: ID=6b6167fc253765ae:T=1697409469:RT=1697409469:S=ALNI_MY1y4XpODq1hwkKwCAW5dJdKaH3qw
.fontesk.com/	1970-01-21 00:51:45	Name: __gpi Value: UID=00000d99ead970b0:T=1697409469:RT=1697409469:S=ALNI_MZR9Gkm5K1nh9cOL5GcEzv7_gsGIQ
.openx.net/	1970-01-21 00:15:45	Name: i Value: 4f783325-cded-4be5-87a7-887070b63f86\|1697409470
.teads.tv/	1970-01-21 00:14:19	Name: tt_viewer Value: 61924171-78d4-48ff-baf4-5b1f93b5a22f
.doubleclick.net/	1970-01-20 15:30:13	Name: DSID Value: NO_DATA
.flashtalking.com/	1970-01-21 00:59:33	Name: flashtalkingad1 Value: "GUID=57661D6D6E92A9"
.fontesk.com/	1970-01-21 01:06:09	Name: _ga_445N6DQJQ8 Value: GS1.1.1697409468.1.0.1697409471.57.0.0
.googleadservices.com/	1970-01-20 17:39:45	Name: ar_debug Value: 1
.fontesk.com/	1970-01-21 00:15:45	Name: FCNEC Value: %5B%5B%22AKsRol8WNwWML_cFXMBVi5PstBKYjbGhCV3z7agTrHerJU26GlDq3k0R9Fm3UOpORIB7sfMzeaxb0hXZ_US8fX45UAm-gHglcC5-2yP0_i2UEe3dNsg1Mk8oIjyCmXCnvzX0R0lGt-OYjcN8EEIcCs7HZErlZy7O3Q%3D%3D%22%5D%2Cnull%2C%5B%5D%5D

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://ctxtfl.com/scripts/js/m.js?id=1Aw020Tsb95W9PdgIrK1GED5D&cb=2351937016&adv=12410607&buy=30696125&cid=202318839&pid=378057975&ok=ok(Line 33) Message: The devicemotion events are blocked by permissions policy. See https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
deprecation	warning	URL: https://cdn.flashtalking.com/frameworks/js/api/2/10/html5API.js Message: Listener added for a synchronous 'DOMNodeInserted' DOM Mutation Event. This event type is deprecated (https://w3c.github.io/uievents/#legacy-event-types) and work is underway to remove it from this browser. Usage of this event listener will cause performance issues today, and represents a risk of future incompatibility. Consider using MutationObserver instead.
deprecation	warning	URL: https://cdn.flashtalking.com/frameworks/js/api/2/10/html5API.js Message: Listener added for a synchronous 'DOMNodeRemoved' DOM Mutation Event. This event type is deprecated (https://w3c.github.io/uievents/#legacy-event-types) and work is underway to remove it from this browser. Usage of this event listener will cause performance issues today, and represents a risk of future incompatibility. Consider using MutationObserver instead.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adstudio-asset-lib.flashtalking.com
analytics.google.com
cdn.flashtalking.com
cm.g.doubleclick.net
ctxtfl.com
dsum-sec.casalemedia.com
fontesk.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
p4-dvsu22ov4x7hc-4fqeuhljqbrbumfn-if-v6exp3-v4.metric.gstatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
s0.2mdn.net
servedby.flashtalking.com
stats.g.doubleclick.net
sync.teads.tv
tpc.googlesyndication.com
us-u.openx.net
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
104.112.20.199
104.18.27.193
104.76.104.56
142.251.111.154
142.251.16.156
142.251.163.132
142.251.163.155
142.251.163.94
142.251.163.99
142.251.167.155
172.253.115.101
172.253.115.148
172.253.122.155
172.253.63.155
172.253.63.95
172.253.63.97
209.16.158.135
216.239.34.181
23.44.208.234
34.107.189.102
34.98.64.218
54.192.51.80
68.67.179.155
041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51
08f3747a1e5f2ab412c6448b80e5dc23ed566a05d0d16be95fd553d171418f9d
09bf1e08fd28c0d20259fa8dc40e44e2da04d0c6ae4e5e0bad28a08df41883fe
0ac9a63e8e0753eddca5bb35b1a5bf103d220313411958d50083c8a33938b779
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0f14858a72f4127384ce7c0ba1aa1eda2d4a8a8df92061ee4611a8f057f32b94
0f9d27037405494787cd35a5742b2dd2ce06f72ffd110dcdc48148388ed2571a
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
12dfce02502b0b0f85917255c36a8ee0bbe18f4ae21f2560c470a66332e38d5a
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1c3a28f09c658fbab4c84aa58010f2f86c2c2ae49e95dd40828d51f3f4e26d9b
1da91e1e602d2ed0a0e999aabe29b9033dda4a44c492b20897152fe1d2dbc7c8
1dbc05b4740d823839cc8fe7c0eaba8566e1318c5a068c96b9dc64ea19b8bfb9
225d27018f230a36201b9ef518df754cc8d7ce7fd0cb1145ff3c9aaefbd8abf8
22cf17f7e47177d0305a0cf4a254015a07db3b8ce9c92cbaf28bed815c39461a
24331bbdf40c95e911c59ea6beb4dea06c862b129605ad6f06f845fc1f0f059e
262224e34eafa2556bc48f8a13a2734bc1336d77cc4325febaee595991e5b782
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254
2ca79572ed475ed817422bc6d7fb46d6c761ca8089a91c560104d03fdff438fd
2cd2a0d2ae4989b9ac86e15ef133ff27a2ce1cdbda83419e0489e4f3bceff9c1
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
306309bb97dd5c43752d1a3f747d956dc5b1ce7ea3b9f63ce50b3947854b0b5d
307b097e4a0019e300a74e226a50b770fd20d56e2b6efafab8ee82a59db2f566
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
37c1ad422302a6b0082e02df9a0704f8e78156edaa378fd3d0e43468fe3e08de
38a1c4bec530bf672936b3930579412f6e464808681f88c45a6db47f54e7362a
38a862b27591a933405008c26eec102821fb0a4492c0f75b79ad3c21e8a95173
3d657ec1e1cad2825dba037cd4bcf80aecc08d3978f3c0de6e22d326ddbd14f3
3f54399e354e9d8a91bb2bf19e612d8441b697ea2d1612a9e107c2923464a23b
3ff684c4492a4c057f332f9791d4b66381b7d9c428c41b61b2b12aa2eb8d1ffe
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b82c56bc4cbc34033b250b03db2a19c148069c2d89872f0005efacb47560292
4c177e4e7d46fc0cd191cfd21e1d4fb24229e5c03e491cec02b6a4cd1c459ded
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5073a7c4afba7e884cb28b46a1e11a716953f9a5e759589f259b67c5234ccae0
528804f12be9081fd9c3590eeb702ad54cd8e73aa475c5590a74e3e0a6151f1c
52f43d412e17ca98125db572a57f219315f41d780aa235d35b76aab5bdcb4d8b
543c9a55d000f237f2908286f57209373c7863687dc8c91cc6586c01428a9097
559ffef94e5dfe1a2f93d44609a27f2374364d115f3bb31b12443c2769e714ca
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5674b0a11a287377a390c9a6c3c2946b3304596cb4fd10a63f5203a3a85f8a31
5b4107bf5bcb1319c0eb3c9d3b5f8d4d96dbad45303f746260ac376888cf595e
5e2ae1df29c8b0c4b986b2d7affafe25e35bb6eaf8a90bb751eea4639edeaeb5
6009c9ac26db5e2346105cea724729d420a4ca5eb89208e2565faa9013f1b976
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
631c7291c16092cef8100ae2c930b787bb8d403ec0aa5f7a0aaa8315e1c79aff
6393ecabbf74e0536c0e3830bbc811623f5c03ecd333058d0aa826e0fc4c514b
63f3df4bf2104aa23a3739385a9cbd0b84a434cdbbd838d2a2ceecff1cd5a172
6563f08627fa2cd60c0c300318405b6f545f0d7f469df6ba87c9e31ecc987217
65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e
684586e6772ee02828185ad005ffaf74fda242faf446b3107c68f0aff86ecef9
6992d29f1d376a718139e05e9e96a8a0158e01c6f237c1036a34c03cdec64017
6b205579c96d4af81de9760c8d15e8650ae5cf631d9d33f9b4ebe043bca11e8b
6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc
6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd
6d16450a4b99217e47f194f24d4b2b6bec48cddc703482d9fde182f30a35bd5f
6d4d45741f0c95f5bde69da00795701b901568998bb079c28a7f90034fcc3486
6d95f4fdd5d8790fae4e9f0c01fb01461e5695dd458d29dcf331c7f6819fb2bf
70bbf6738099d0cad621f6d010c19eeb4d842fe77a9bb6902caf393e5a451324
71ac3ef341fa8de6312d99bbb8f4f634f945c42f7c79b8a41efaec04755594bb
73e3191e8775f3d00119696caa79759b2ae87b5bf058bf6a66b626eb04580244
77b1c57ff49aef85b5c11db08fb449b4f7b36b3cc833afd94b826d718b6ff1b4
7b27c8df26a25938b5054d1dd3ff31601231bbfa6a9e600b2976db55ed4465ac
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
7c82f397a0ac147e592493d7bc8889388ad6ae2b65d069c39222e0ea24385eed
7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e
7db71de8593ed0813a1c6b5b676fc56098b793915e9a12cbd5f1aac4517e270d
7e4aed045d37bd4d19a509734ab12187cdc030a518ca933cda82032006914bd7
7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85
80b0240a614b9c4e980265c79d67ec0a2e59448674d7d8324ee17af2b35118d9
815f02681d0fd52b5f52e8c3fca5e754fefb3c83c2eed47b63fd3c3228628cd6
883340c9cd61a0bcbc7710b16ae16b1f89441492fbff4fba713818998a491dc5
90bb128a583d62944d449e07f21b9a1da1fd7b3f7a5e2a2725fa028de809d108
914408bbcbb862bf8d2c7ea6a174f2d2db2cbd23609c79823bb26fa694a9bc0c
91701c746053a0c71e304f67aea5037abe2d2dc6ef18b54d0ab962b4dcd8a56d
919664d4c088d6963c5c872ced7e8859a3cabc2cec3ef42f4afa99de7a3321da
91b2efa7f6f27aeb2bd108a6f93cb87b68c56acebcb037372084a46471280d75
923c7b157bd36e8b18040eef8ef6c7984c3f0585122973c2d12335b894efe44c
93238057168c959a4d207b6581961ab01c778f7833aa7f1f0d85d452495d49b2
9590dff58da946472b892f7152dfd4999defba8934f2a2f472086253489e0a36
96477eb47aaf4572b26b38a8f10631b5ce4d0bc3bcda800d747aa3c11acdcbdf
9924dafc5fc51aee726ebaacf7355191bd5d2d74eff18f7ae0ce57903ff12cd2
9adc7199c788b4fa2a30f6c8f79066b81300547c3d626d26cf825ad6e1635cfe
9c1cb588e62a0242cf7fe7cd297b3fddf1b237feb5bfe54159769b4e734b6783
9d845c9e205266b115edf3be61059f1ac165ba22ba84911b25175e45c845b23f
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a023ff6658dee5aa71f1d92e83eaf4e5c8f6fff3a5f11f3675d0a2ee8a311b7f
ad0433539e1a76d42c6dd403cd6fed2a0776292d83a21d56e895304f7fce9a3e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bb183010759f5683162a5dde5e737ca6aa9d34f8b1b862bf18343b858d811190
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb5786988eb66624cda0e923e32b40ba3af7d7b8c32f231d5f71f0b99c3b70ca
bb5fdd08e21a0aeb847742475ffbad5e69857085ae6c7821e771c31baa839b59
be2e04cecbcfd781b640159d04691b2add96725759f769d0a253727dd74b3c2d
be8125fd9d7140c9b4ec7cb377b9dea121d067fcac6119c4f924d0da3617c135
be944f929181b5de70d2b8323e5b606ddaf45da2b38f1ca0103977fca4bb930e
bef9bb259e6addb554532ad5a02e5d96ce6731e8f0e26524d7b18ddc7f0e3353
bf09c167e2eff72ba45c25dca75d677c16bd048d9589832afe38cb30bcaf836a
c426be49b7aea3a132da3dbcac53585a3cf8deefc632874ebb94bac37d890f3d
c45c8b81ccfcbc08127b74787d1b5974078756233de947986c357e28ed8f13ac
c75166534a7cf375f7963558a6a55858688f6c289c9d200706ce1592669ffe3b
c908c62fead4036b06f6d10213cfad3bbbc3ca3aa4f8a6eb81dd9ad598f73fa4
c9c28c896f747e79d0ea3b0c58dc4de3eca6379087856f360d260f146ac1f7c1
cc5025ccbf36f2827a60152181b6b8df32e15fa5a5926b70f8f0b97d073f3881
cf88d530c655fa92a90277d42f7c7cbb19fe276a0de7f126a26d26dfc865d7f5
cfc4c2a0dd286b3ae6a1f3e0b70a611fa1182770bc945e03a0b1803062fa5f37
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d1c596d958d64e0145a006c24702e41cd888149eb25c290de827e211b3043742
d22a5815111d8a60a1bfa58b46b1447dd0ea420e12fbb0e0d362d76cbbb2b02a
d2457f8da7d5b9d2cbb0ba84378e99a9e426fc0bfe41ed68bcee8535aa38c416
d628acb31a172a47e61e0a8f479bfa080ca695b882aec44c07545d96ac912202
da370f7edf80393f81e9b31645df2fffc6ed33462b3a1ff86626681ce0d2e030
def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15
df24d70954a21bd35ed6853799dc0505bfc110bcf417dc3af628e2c4dbd699c0
e102462cd94a7e7573dd74233c5f56d3770f732649a2b1d3eff05775d082b013
e323bad19d6fa0da7a34af462c4c5191dcbeccf66ca1c45cb70f81e0c8295f2e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ebb775e5f2895db88b2bfa53a935487cfc95fe2023cffa65be421ee258cd45d4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6a9d44d0ca2a61e2b7ce5277a5bca9bdfb71ce6d743237e32d467efb75afc8
fa1a995b616d95bab627298ed75f2c4985633feabc84a0aa635b242dab18c295
fba3319355d570de938a0eee92bfd4c37c849e0ad53bc69df99d14334f904bfb
fc069e0e04d13807f2632483a883ed5fbd1d72c4eade64a9ac7f6aa71ac47fa4

fontesk.com Open in urlscan Pro 209.16.158.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

216 Requests

92 %HTTPS

0 %IPv6

17 Domains

27 Subdomains

24 IPs

3 Countries

3942 kBTransfer

7481 kBSize

17 Cookies

5 Outgoing links

Page URL History

Redirected requests

216 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

fontesk.com Open in urlscan Pro
209.16.158.135 Public Scan

Screenshot
Live screenshot

Full Image

216
Requests

92 %
HTTPS

0 %
IPv6

17
Domains

27
Subdomains

24
IPs

3
Countries

3942 kB
Transfer

7481 kB
Size

17
Cookies

216 HTTP transactions
8 data transactions